Query: detection rule: Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running
Matching passage: Sigma rule: Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running. Logsource: windows / registry_set. Rule: title: Internet Explorer DisableFirstRunCustomize Enabled id: ab567429-1dfb-4674-b6d2-979fd2f9d125 status: test description: 'Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows. ' references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/ - https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 modified: 2025-10-07 tags: - attack.defense-impairment logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Microsoft\Internet Explorer\Main\DisableFirstRunCustomize Details: - DWORD (0x00000001) - DWORD (0x00000002) filter_main_generic: Image: - C:\Windows\explorer.exe - C:\Windows\System32\ie4uinit.exe filter_optional_avira: Image|contains|all: - \Temp\ - \.cr\avira_ Details|contains: DWORD (0x00000001) filter_optional_foxit: Image: - C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe - C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe Details|contains: DWORD (0x00000001) condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - As this is controlled by group policy as well as user settings. Some false positives may occur. level: medium
Near-miss passage: Sigma rule: Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. Th. Logsource: windows / process_creation. Rule: title: BitLockerTogo.EXE Execution id: 7f2376f9-42ee-4dfc-9360-fecff9a88fc8 status: test description: 'Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing. ' references: - https://tria.ge/240521-ynezpagf56/behavioral1 - https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091 - https://bazaar.abuse.ch/sample/8c75f8e94486f5bbf461505823f5779f328c5b37f1387c18791e0c21f3fdd576/ - https://bazaar.abuse.ch/sample/64e6605496919cd76554915cbed88e56fdec10dec6523918a631754664b8c8d3/ author: Josh Nickels, mttaggart date: 2024-07-11 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \BitLockerToGo.exe condition: selection falsepositives: - Legitimate usage of BitLockerToGo.exe to encrypt portable devices. level: low