Potential Attachment Manager Settings Tampering
This rule detects attempts to tamper with Windows Attachment Manager settings by modifying specific registry values. These modifications can disable security features related to file attachments, such as hiding zone information, preventing the saving of zone information, or disabling antivirus scanning for downloaded files. Such actions are often performed by adversaries to evade detection and facilitate the execution of malicious files.
Sigma
