Modification of Internet Explorer Registry Settings for Persistence

This brief addresses the risk of attackers modifying Internet Explorer (IE) registry keys under the path HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings. While IE is largely deprecated, these registry paths are still utilized by various Windows components for managing zones, proxy settings, and security policies. Attackers may abuse these keys to add malicious domains to the Trusted Sites zone, effectively lowering security restrictions for specific websites, or inject JavaScript via registry values to achieve persistence or execute code within the context of applications that rely on these settings. This activity is often part of a broader post-exploitation phase to maintain access or modify the security posture of an endpoint.

Impact

Successful exploitation allows attackers to bypass security boundaries, maintain persistence across reboots, and execute scripts in the context of authorized processes that reference these registry settings. This can facilitate further credential theft, data exfiltration, or secondary stage malware execution.

Recommendation

1. Deploy the provided Sigma rule to detect anomalous registry modifications in the Internet Settings path.
2. Implement an allowlist for known-good configuration tools and processes that modify these registry keys.
3. Enable Sysmon or Windows Event Log auditing (Event ID 13) for registry value set operations.