Identifying Domains Added Into Browser Security Zones Via CLI
Query
DeviceEvents
| where AdditionalFields contains "ZoneMap"
| extend command = split(AdditionalFields, ' ')
| mv-expand command
| where command contains "ZoneMap"
| extend command = tostring(command)
| extend command = split(command, '\\')
| mv-expand command | extend tostring(command) | where command endswith "'"
| extend CleanedKey = replace(@"'", "", command)
// in case you have trusted domains allowed to be whitelisted, add them in the next line
| where CleanedKey !in ("google.com")
| distinct Timestamp, DeviceName, AdditionalFields, CleanedKey, ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1112 | Modify Registry |
Author: Sergio Albea (27/02/2025)
Identifying domains added into browser security zones via CLI
Description: The ZoneMap key under Internet Settings is used to define security zones for specific domains. By setting a value under ZoneMap\Domains, you are configuring how Windows handles security and permissions for that domain so it is really helpful to identify if some site has been added via cli manually or by some malicious script to whitelist some domains and bypass some defense.
Explanation
This query is designed to identify domains that have been added to browser security zones via the command line interface (CLI). It focuses on detecting potentially unauthorized or malicious modifications to the Windows registry, specifically under the "ZoneMap" key in Internet Settings. This key is used to define security zones for specific domains, which affects how Windows handles security and permissions for those domains.
Here's a simplified breakdown of what the query does:
-
Source Data: It starts by looking at
DeviceEventswhere theAdditionalFieldscontain the term "ZoneMap". This indicates that the event is related to changes in the Internet security zones. -
Extracting Commands: The query splits the
AdditionalFieldsto isolate commands related to "ZoneMap". It further processes these commands to extract specific domain entries. -
Cleaning Data: It removes any extraneous characters (like quotes) from the extracted domain entries to clean up the data.
-
Filtering: The query filters out any domains that are known and trusted (e.g., "google.com") to focus on potentially suspicious entries.
-
Output: Finally, it provides a distinct list of events with their timestamps, device names, additional fields, cleaned domain keys, and report IDs.
In summary, this query helps identify domains that have been added to browser security zones via CLI, which could indicate an attempt to bypass security measures by whitelisting certain domains.
