Warzone RAT Registry Modification for Connection Persistence

Warzone RAT (also known as Ave Maria) is a remote access trojan that functions as both a credential stealer and a tool for unauthorized network activity. It has been observed modifying specific Windows registry settings, specifically 'MaxConnectionsPerServer' and 'MaxConnectionsPer1_0Server' located under 'Internet Settings'. By setting these values to '0x0000000a', the malware increases the allowable concurrent connections to a remote server. This modification is significant for defenders as it enables attackers to perform more effective lateral movement, maintain stable command-and-control communication, or participate in distributed denial-of-service (DDoS) campaigns. This activity represents a clear attempt to reconfigure system network behavior to better suit the malicious objectives of the RAT.

Impact

Successful exploitation of this registry modification allows the Warzone RAT to evade standard connection throttling limits, enabling persistent and high-volume communication with attacker-controlled infrastructure. This configuration change impacts the security posture of the host by facilitating unauthorized lateral movement across the enterprise network and increasing the potential for the compromised system to be used as a node in network-based attacks.

Recommendation

1. Deploy the provided Sigma rule to detect unauthorized modifications to the 'Internet Settings' registry keys.
2. Baseline the standard 'MaxConnectionsPerServer' registry values across your environment to identify systems that deviate from your organizational configuration.
3. Monitor Sysmon Event ID 13 for registry set operations targeting the specific paths identified in this brief.