diff --git a/rules/windows/registry_event/registry_event_ie_persistence.yml b/rules/windows/registry_event/registry_event_ie_persistence.yml index 70e6f6566..35b79c8a8 100644 --- a/rules/windows/registry_event/registry_event_ie_persistence.yml +++ b/rules/windows/registry_event/registry_event_ie_persistence.yml @@ -3,7 +3,7 @@ id: d88d0ab2-e696-4d40-a2ed-9790064e66b3 description: Detects the modification of the registry settings used for Internet Explorer and other Windows components that use these settings author: frack113 date: 2022/01/22 -modified: 2022/03/25 +modified: 2022/03/29 status: experimental references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry @@ -25,6 +25,7 @@ detection: TargetObject|contains: - '\Cache' - '\ZoneMap' + - '\WpadDecision' filter_binary: Details: 'Binary Data' condition: selection_domains and not 1 of filter_*