Windows Registry and PowerShell Modification of ms-settings Protocol Handler

Flags reg.exe or PowerShell registry edits that alter the ms-settings protocol handler open command path.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-12-20
Updated: 2026-07-30

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
- T1546.001Change Default File Association
Priv Esc
- T1546.001Change Default File Association
- T1548.002Bypass User Account Control
Defense Evasion
- T1112Modify Registry
- T1548.002Bypass User Account Control
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies changes to the ms-settings protocol handler command path when registry modifications are performed via reg.exe or through PowerShell. Attackers may use this to redirect protocol execution to attacker-controlled commands, enabling persistence or privilege impact. The detection relies on process creation telemetry that captures reg.exe or PowerShell command-line activity containing specific protocol handler registry key paths and property modification commands.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Suspicious Remote UAC Restriction Disabled via LocalAccountTokenFilterPolicy (via process_creation)

Suspicious LocalAccountTokenFilterPolicy Registry Modification

Windows Registry: Alert on Changes to \shell\open\command Targeting Common Malware Paths

Malicious Enabling of Restricted Admin Mode via Registry by UAT-8837

Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware

Malicious Service DLL Hijack for Persistence via Lotus Blossom

Malicious FodHelper UAC Bypass via ms-settings Shell Command Hijack (via registry_set)

Suspicious Loopback Proxy Server Configured via Registry (via registry_set)

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Windows Registry and PowerShell Modification of ms-settings Protocol Handler

Pivot detection · T1112 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-and-powershell-modification-of-ms-settings-protocol-handler-dd3ee8cc

title: Windows Registry and PowerShell Modification of ms-settings Protocol Handler
id: 43ae4950-1556-42b8-b640-c8faedb6e83a
related:
  - id: 152f3630-77c1-4284-bcc0-4cc68ab2f6e7
    type: similar
  - id: dd3ee8cc-f751-41c9-ba53-5a32ed47e563
    type: derived
status: test
description: This rule identifies changes to the ms-settings protocol handler command path when registry modifications are performed via reg.exe or through PowerShell. Attackers may use this to redirect protocol execution to attacker-controlled commands, enabling persistence or privilege impact. The detection relies on process creation telemetry that captures reg.exe or PowerShell command-line activity containing specific protocol handler registry key paths and property modification commands.
references:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
  - https://www.trendmicro.com/en_us/research/25/f/water-curse.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_registry_modification_of_ms_setting_protocol_handler.yml
author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2021-12-20
modified: 2026-01-24
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.defense-impairment
  - attack.t1548.002
  - attack.t1546.001
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_pwsh_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - powershell.exe
        - pwsh.dll
  selection_reg_cli:
    CommandLine|contains: add
  selection_pwsh_cli:
    CommandLine|contains:
      - New-ItemProperty
      - Set-ItemProperty
      - "ni "
      - "sp "
  selection_cli_key:
    CommandLine|contains: \ms-settings\shell\open\command
  condition: (all of selection_reg_* or all of selection_pwsh_*) and selection_cli_key
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL