Registry Modification for Proxy Bypass

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•2

This rule detects attempts to modify registry keys related to proxy settings, specifically 'ProxyOverride', 'ProxyServer', or 'NoProxy', to include local bypass addresses such as 'localhost', '127.0.0.1', or '<local>'. This activity could indicate an adversary attempting to bypass network proxies for command and control or data exfiltration.