Windows Registry Proxy Server Modification

This analytic detects modifications to the Windows registry key responsible for setting up a proxy server. It specifically looks for changes to the "Internet Settings\\ProxyServer" registry path. Such modifications can indicate that malware or an adversary is configuring a proxy to establish unauthorized communication channels, potentially for Command and Control (C2) or data exfiltration. The rule leverages Sysmon EventID 13 data, which records registry value set operations.