ZDI-26-708: Unpatched Microsoft Windows HTTP Proxy Local Privilege Escalation — Detection and Hardening Guide

---
title: Proxy Auto-Config URL Tampering via Registry
id: 3f7a1c92-8e4d-4b5a-9c12-7d2e5f8a9016
status: experimental
description: Detects modification of per-user proxy AutoConfigURL or ProxyServer settings, a behavior associated with abuse of the Windows HTTP Proxy component and post-exploitation traffic redirection.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-708/
  - https://attack.mitre.org/techniques/T1112/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL'
      - '\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer'
      - '\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings'
  filter_legitimate_browsers:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
  condition: selection and not 1 of filter_legitimate_*
falsepositives:
  - Enterprise GPO-driven proxy configuration deployment
  - Browser first-run configuration
level: medium
---
title: WinHTTP Proxy Configuration Changed via Netsh
id: 9c4e2b17-6f3a-4d8c-b2e1-4a7f9d3c5e82
status: experimental
description: Detects use of netsh to modify WinHTTP proxy settings, which can precede or follow abuse of HTTP proxy handling and is rarely performed outside administrative change windows.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-708/
  - https://attack.mitre.org/techniques/T1112/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\netsh.exe'
    CommandLine|contains|all:
      - 'winhttp'
      - 'proxy'
    CommandLine|contains:
      - 'set'
      - 'import'
falsepositives:
  - Legitimate administrative proxy configuration during system provisioning
level: medium
---
title: Child Process Spawned by WinHTTP AutoProxy Service Host
id: 5b8d3f61-2a9c-4e7b-a1d4-8c6e2f5b9037
status: experimental
description: Detects unexpected child processes spawned by the svchost instance hosting the WinHTTP Web Proxy Auto-Discovery Service, which may indicate successful exploitation of the HTTP proxy component for privilege escalation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-708/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentCommandLine|contains: 'WinHttpAutoProxySvc'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
falsepositives:
  - Rare; investigate any hit
level: high

let lookback = 7d;
let ProxyRegEvents =
    DeviceRegistryEvents
    | where Timestamp > ago(lookback)
    | where RegistryKey has @"Software\Microsoft\Windows\CurrentVersion\Internet Settings"
    | where RegistryValueName in~ ("AutoConfigURL", "ProxyServer", "DefaultConnectionSettings")
    | where InitiatingProcessFileName !in~ ("msedge.exe", "chrome.exe", "firefox.exe", "svchost.exe", "System")
    | project RegTime=Timestamp, DeviceId, DeviceName, RegistryValueName, RegistryValueData,
              InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;
let SuspiciousSvcChildren =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessCommandLine has "WinHttpAutoProxySvc"
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "wscript.exe", "cscript.exe", "mshta.exe")
    | project ChildTime=Timestamp, DeviceId, DeviceName, ChildProcess=FileName, ChildCommandLine=ProcessCommandLine,
              InitiatingProcessCommandLine, AccountName;
ProxyRegEvents
| join kind=fullouter SuspiciousSvcChildren on DeviceId
| extend AlertTime = coalesce(RegTime, ChildTime)
| summarize arg_max(AlertTime, *) by DeviceId, DeviceName
| project AlertTime, DeviceName, RegistryValueName, RegistryValueData,
          InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName,
          ChildProcess, ChildCommandLine, AccountName
| order by AlertTime desc

-- Hunt for anomalous per-user proxy configuration across all user hives
-- Suspicious: AutoConfigURL set to non-corporate values, ProxyServer pointing to localhost or unexpected hosts
LET users = SELECT Name, Uid FROM Artifact.Windows.Sys.Users()
SELECT Name AS UserName,
       AutoConfigURL,
       ProxyServer,
       ProxyEnable,
       FullPath AS RegistryPath
FROM foreach(row=users,
query={
    SELECT AutoConfigURL, ProxyServer, ProxyEnable, FullPath
    FROM read_reg_key(key="Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                      accessor="raw_reg", root="HKEY_USERS\\" + Uid)
})
WHERE AutoConfigURL OR (ProxyEnable AND ProxyServer)

# ZDI-26-708 Audit Script — Windows HTTP Proxy LPE (unpatched)
# Run elevated. Outputs findings to console and a CSV for SIEM ingestion.

$results = @()

# 1. Audit WinHTTP system-wide proxy configuration
Write-Host "=== WinHTTP System Proxy Configuration ===" -ForegroundColor Cyan
$winhttp = netsh winhttp show proxy
$winhttp

# 2. Audit per-user proxy settings in all profiles
$profiles = Get-ChildItem "Registry::HKU" | Where-Object { $_.PSChildName -match '^S-1-5-21' }
foreach ($profile in $profiles) {
    $keyPath = "Registry::$($profile.PSChildName)\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
    if (Test-Path $keyPath) {
        $props = Get-ItemProperty -Path $keyPath -ErrorAction SilentlyContinue
        $autoUrl  = $props.AutoConfigURL
        $proxySrv = $props.ProxyServer
        $proxyOn  = $props.ProxyEnable
        if ($autoUrl -or ($proxyOn -eq 1)) {
            $suspicious = $false
            # Flag PAC URLs or proxy servers pointing to localhost, RFC1918, or non-HTTPS
            if ($autoUrl -match '127\.0\.0\.1|localhost|http://[^/]*\.(local|internal)') { $suspicious = $true }
            if ($proxySrv -match '127\.0\.0\.1|localhost') { $suspicious = $true }
            $results += [PSCustomObject]@{
                SID           = $profile.PSChildName
                AutoConfigURL = $autoUrl
                ProxyServer   = $proxySrv
                ProxyEnabled  = $proxyOn
                Suspicious    = $suspicious
                Host          = $env:COMPUTERNAME
            }
        }
    }
}

# 3. Check AutoProxy service state and binary path integrity
Write-Host "`n=== WinHttpAutoProxySvc State ===" -ForegroundColor Cyan
$svc = Get-CimInstance Win32_Service -Filter "Name='WinHttpAutoProxySvc'"
$svc | Select-Object Name, State, StartMode, PathName | Format-List

# 4. Export findings
$outPath = "$env:ProgramData\SecurityAudit\ZDI-26-708-ProxyAudit-$(Get-Date -Format 'yyyyMMdd-HHmmss').csv"
New-Item -ItemType Directory -Path (Split-Path $outPath) -Force | Out-Null
$results | Export-Csv -Path $outPath -NoTypeInformation

if ($results | Where-Object { $_.Suspicious }) {
    Write-Host "`n[ALERT] Suspicious proxy configuration detected — investigate before remediation." -ForegroundColor Red
    $results | Where-Object { $_.Suspicious } | Format-List
} else {
    Write-Host "`n[OK] No anomalous proxy configuration found. Results: $outPath" -ForegroundColor Green
}

# 5. Optional: baseline AutoConfigURL values now so drift detection is possible later.
# Do NOT blank proxy settings on production systems without validating dependencies —
# WPAD/PAC is load-bearing in many enterprise environments.