Windows Registry and PowerShell Modification of ms-settings Protocol Handler

Flags reg.exe or PowerShell registry edits that alter the ms-settings protocol handler open command path.

FreeUnreviewedSigmamediumv1

windows-registry-and-powershell-modification-of-ms-settings-protocol-handler-dd3ee8cc

title: Windows Registry and PowerShell Modification of ms-settings Protocol Handler
id: 43ae4950-1556-42b8-b640-c8faedb6e83a
related:
  - id: 152f3630-77c1-4284-bcc0-4cc68ab2f6e7
    type: similar
  - id: dd3ee8cc-f751-41c9-ba53-5a32ed47e563
    type: derived
status: test
description: This rule identifies changes to the ms-settings protocol handler command path when registry modifications are performed via reg.exe or through PowerShell. Attackers may use this to redirect protocol execution to attacker-controlled commands, enabling persistence or privilege impact. The detection relies on process creation telemetry that captures reg.exe or PowerShell command-line activity containing specific protocol handler registry key paths and property modification commands.
references:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
  - https://www.trendmicro.com/en_us/research/25/f/water-curse.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_registry_modification_of_ms_setting_protocol_handler.yml
author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2021-12-20
modified: 2026-01-24
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.defense-impairment
  - attack.t1548.002
  - attack.t1546.001
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_pwsh_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - powershell.exe
        - pwsh.dll
  selection_reg_cli:
    CommandLine|contains: add
  selection_pwsh_cli:
    CommandLine|contains:
      - New-ItemProperty
      - Set-ItemProperty
      - "ni "
      - "sp "
  selection_cli_key:
    CommandLine|contains: \ms-settings\shell\open\command
  condition: (all of selection_reg_* or all of selection_pwsh_*) and selection_cli_key
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule identifies changes to the ms-settings protocol handler command path when registry modifications are performed via reg.exe or through PowerShell. Attackers may use this to redirect protocol execution to attacker-controlled commands, enabling persistence or privilege impact. The detection relies on process creation telemetry that captures reg.exe or PowerShell command-line activity containing specific protocol handler registry key paths and property modification commands.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.