Skip to content
Threat Feed
Subscribe
medium advisory

Internet Explorer DisableFirstRunCustomize Registry Modification

This detection identifies the modification of the Internet Explorer DisableFirstRunCustomize registry key, a technique previously associated with malware installers and defense impairment to suppress browser initialization wizards.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
Medium
Action
Monitor or close
Sources
4 public sources
Freshness
Revision 1Nov 10, 03:09 UTC
Detection
1 rule
Source quality
A2Likely

The modification of the DisableFirstRunCustomize registry key prevents Internet Explorer from triggering the first-run initialization wizard. While this key can be managed via Group Policy, it has historically been observed as an artifact used by various malware campaigns and installers to suppress user-visible browser initialization prompts. This brief provides a detection rule to identify non-standard modifications to this registry path.

Impact

Legitimate use of this key is common via corporate Group Policy Objects (GPOs). Unauthorized modification may indicate an attempt by malicious software to suppress browser setup or perform silent modifications to browser behavior.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to monitor for unauthorized modifications to the DisableFirstRunCustomize registry value.
  • Baseline existing GPO-managed systems to identify expected modification patterns and tune the detection filters to reduce noise.
  • Investigate any suspicious processes modifying this key that originate outside of expected administrative processes or known software installers.

Immediate actions

Deploy Sigma rule to monitor for registry persistence

Detection Engineering 7d

Threat Hunt

Search for unknown processes modifying registry paths under HKLM/HKCU \Microsoft\Internet Explorer\Main

T1562 medium medium confidence convert to detection

Data: Registry set telemetry

Mitigations

Enforce browser initialization settings via secure GPO

medium IT Operations

Defense impairment via browser configuration

Detection coverage 1

Detect Modification of Internet Explorer DisableFirstRunCustomize

medium

Detects changes to the Internet Explorer DisableFirstRunCustomize value which prevents the first run wizard, a technique used for defense impairment or silent installation

sigma tactics: defense-impairment sources: registry_set, windows

Detection queries are available on the platform. Get full rules →