Modification of Internet Explorer Registry Settings
This rule detects modifications to Internet Explorer registry settings, which attackers can abuse for persistence or defense evasion. Specifically, it looks for changes within the 'Software\Microsoft\Windows\CurrentVersion\Internet Settings' registry path. Potential malicious activities include adding domains to the Trusted Sites Zone or injecting JavaScript for persistence. The rule filters out common benign modifications related to DWORD values, Office applications, cache, ZoneMap, WpadDecision paths, binary data, and changes made by 'RuntimeBroker.exe' or within 'Accepted Documents' to reduce false positives.
Sigma
