Possible Persistence Through Custom Protocol Handler (via registry_set)

title: Possible Persistence Through Custom Protocol Handler (via registry_set)
id: 69fc933e-65c4-5b43-9cd7-5258e75f119a
status: stable
description: This rule detects potential persistence behavior via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers frequently times during installation. And adversary can misuse this by setting a custom handler to be used as a persistence mechanism.
references:
    - https://attack.mitre.org/techniques/T1112/
    - https://ladydebug.com/blog/2019/06/21/custom-protocol-handler-cph/
author: Huntrule Team
date: 2026-04-20
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|startswith: 'HKCR\'
        Details|startswith: 'URL:'
    filter_main_ms_trusted:
        Details|startswith: 'URL:ms-'
    filter_main_generic_locations:
        Image|startswith:
            - 'C:\Program Files (x86)'
            - 'C:\Program Files\'
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium