Sigma rule: Internet Explorer DisableFirstRunCustomize Enabled

Rule

Title

Internet Explorer DisableFirstRunCustomize Enabled

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-05-16

Modified

2025-10-07

File

rules/windows/registry/registry_set/registry_set_internet_explorer_disable_first_run_customize.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|endswith: '\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize'
    Details:
        - 'DWORD (0x00000001)' # Home Page
        - 'DWORD (0x00000002)' # Welcome To IE
filter_main_generic:
    Image:
        - 'C:\Windows\explorer.exe'
        - 'C:\Windows\System32\ie4uinit.exe'
filter_optional_avira:
    Image|contains|all:
        - '\Temp\'
        - '\.cr\avira_'
    Details|contains: 'DWORD (0x00000001)'
filter_optional_foxit:
    Image:
        - 'C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe'
        - 'C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe'
    Details|contains: 'DWORD (0x00000001)'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• As this is controlled by group policy as well as user settings. Some false positives may occur.

Tags

• attack.defense-impairment

References

• https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
• https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
• https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_internet_explorer_disable_first_run_customize.yml