huntrule

Windows Registry ZoneMap Proxy Policy Tampering via SetValueKeyInt

Alerts on Windows ZoneMap registry changes that set proxy/intranet bypass values, using registry set-value telemetry and process image context.

FreeUnreviewedSigmalowv1
title: Windows Registry ZoneMap Proxy Policy Tampering via SetValueKeyInt
id: f5862cf9-591b-4b87-8a35-552c5151d887
status: test
description: This rule flags registry value modifications under the Windows Internet Settings ZoneMap area that enable proxy-related settings or related intranet/UNC bypass behavior. Such changes matter because attackers can use them to influence how Windows handles network destinations, potentially helping malware maintain connectivity through or around existing security controls. Telemetry relies on registry set-value events, including the modified TargetObject path, value type/data (DWORD 0x00000001 or 0x00000000), and the originating Image path to narrow the activity context.
references:
  - https://tria.ge/240225-jlylpafb24/behavioral1/analog?main_event=Registry&op=SetValueKeyInt
  - https://tria.ge/240307-1hlldsfe7t/behavioral2/analog?main_event=Registry&op=SetValueKeyInt
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_ProxyByPass
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_IncludeUnspecifiedLocalSites
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect
  - https://bazaar.abuse.ch/browse/signature/RaspberryRobin/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/Raspberry-Robin/registry_set_malware_raspberry_robin_internet_settings_zonemap_tamper.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-31
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
  definition: 'Requirements: The registry key "\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" and its sub keys must be monitored'
detection:
  selection_registry_image:
    - Image|contains:
        - \AppData\Local\Temp\
        - \Downloads\
        - \Users\Public\
        - \Windows\Temp\
    - Image|endswith: \control.exe
  selection_registry_object:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
  selection_value_enable:
    TargetObject|endswith:
      - \IntranetName
      - \ProxyByPass
      - \UNCAsIntranet
    Details|contains: DWORD (0x00000001)
  selection_value_disable:
    TargetObject|endswith: \AutoDetect
    Details|contains: DWORD (0x00000000)
  condition: all of selection_registry_* and 1 of selection_value_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 16a4c7b3-4681-49d0-8d58-3e9b796dcb43
    type: derived

What it detects

This rule flags registry value modifications under the Windows Internet Settings ZoneMap area that enable proxy-related settings or related intranet/UNC bypass behavior. Such changes matter because attackers can use them to influence how Windows handles network destinations, potentially helping malware maintain connectivity through or around existing security controls. Telemetry relies on registry set-value events, including the modified TargetObject path, value type/data (DWORD 0x00000001 or 0x00000000), and the originating Image path to narrow the activity context.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.