Windows Registry Set Internet Settings ZoneMap Proxy and Intranet Values
Alerts on Windows ZoneMap registry changes that set proxy/intranet bypass values, using registry set-value telemetry and process image context.
FreeReviewedSigma · Low · v4
- Product
- windows
- Category
- registry_set
- Author
- Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
- Published
- 2024-07-31
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows registry value changes under the Internet Settings ZoneMap path that enable or disable proxy-related and intranet zone settings. Attackers and malware may modify these settings to influence how the system routes web requests, potentially bypassing security controls or ensuring communication paths to external infrastructure. The detection relies on telemetry for registry SetValue events, including the modified target object, the DWORD data value, and the originating process image path to help contextualize potentially suspicious activity.
Reporting behind it
- tria.gehttps://tria.ge/240225-jlylpafb24/behavioral1/analog?main_event=Registry&op=SetValueKeyInt
- tria.gehttps://tria.ge/240307-1hlldsfe7t/behavioral2/analog?main_event=Registry&op=SetValueKeyInt
- admx.helphttps://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_ProxyByPass
- admx.helphttps://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet
- admx.helphttps://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_IncludeUnspecifiedLocalSites
- admx.helphttps://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect
- bazaar.abuse.chhttps://bazaar.abuse.ch/browse/signature/RaspberryRobin/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/Raspberry-Robin/registry_set_malware_raspberry_robin_internet_settings_zonemap_tamper.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-zonemap-proxy-policy-tampering-via-setvaluekeyint-16a4c7b3
title: Windows Registry Set Internet Settings ZoneMap Proxy and Intranet Values
id: f5862cf9-591b-4b87-8a35-552c5151d887
status: test
description: This rule flags Windows registry value changes under the Internet Settings ZoneMap path that enable or disable proxy-related and intranet zone settings. Attackers and malware may modify these settings to influence how the system routes web requests, potentially bypassing security controls or ensuring communication paths to external infrastructure. The detection relies on telemetry for registry SetValue events, including the modified target object, the DWORD data value, and the originating process image path to help contextualize potentially suspicious activity.
references:
- https://tria.ge/240225-jlylpafb24/behavioral1/analog?main_event=Registry&op=SetValueKeyInt
- https://tria.ge/240307-1hlldsfe7t/behavioral2/analog?main_event=Registry&op=SetValueKeyInt
- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_ProxyByPass
- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet
- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_IncludeUnspecifiedLocalSites
- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect
- https://bazaar.abuse.ch/browse/signature/RaspberryRobin/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/Raspberry-Robin/registry_set_malware_raspberry_robin_internet_settings_zonemap_tamper.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-31
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
- detection.emerging-threats
logsource:
category: registry_set
product: windows
definition: 'Requirements: The registry key "\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" and its sub keys must be monitored'
detection:
selection_registry_image:
- Image|contains:
- \AppData\Local\Temp\
- \Downloads\
- \Users\Public\
- \Windows\Temp\
- Image|endswith: \control.exe
selection_registry_object:
TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
selection_value_enable:
TargetObject|endswith:
- \IntranetName
- \ProxyByPass
- \UNCAsIntranet
Details|contains: DWORD (0x00000001)
selection_value_disable:
TargetObject|endswith: \AutoDetect
Details|contains: DWORD (0x00000000)
condition: all of selection_registry_* and 1 of selection_value_*
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 16a4c7b3-4681-49d0-8d58-3e9b796dcb43
type: derived