Disabled IE Security Features

Title: Disabled IE Security Features
Status: test
Description:Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features
References:
  -https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
Author: Florian Roth (Nextron Systems)
Date: 2020-06-19
modified:2021-11-27
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection1:
    CommandLine|contains|all:
      -' -name IEHarden '
      -' -value 0 '

  selection2:
    CommandLine|contains|all:
      -' -name DEPOff '
      -' -value 1 '

  selection3:
    CommandLine|contains|all:
      -' -name DisableFirstRunCustomize '
      -' -value 2 '

  condition:1 of selection*
Falsepositives:
  -Unknown
Level: high