YARA · Telekom Security malware analysis

TELEKOM_SECURITY_Get_Windows_Proxy_Configuration

Queries Windows Registry for proxy configuration

Author: Thomas Barabosch, Deutsche Telekom Security
Date: 2022-01-14
Modified: 2023-12-12
Score / Quality: 75 / 70

What this rule detects

Queries Windows Registry for proxy configuration

It defines 3 patterns (3 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from Telekom Security malware analysis, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHub Open the repository

References

https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-ie-clientnetworkprotocolimplementation-hklmproxyserver

Licence & attribution

Author: Thomas Barabosch, Deutsche Telekom Security

Source repository: Telekom Security malware analysis @ 755efb6658

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: b67b0b70-a95f-5c65-a522-ef4f41e36159

Tags:CAPABILITY HACKTOOL

TELEKOM_SECURITY_Win_Systembc_20220311Metadata only
Suspicious / huntingTelekom Security malware analysis· Thomas Barabosch, Deutsche Telekom Security· 2022-03-11

What this rule detects

Rule source

References

Licence & attribution

Related rules