Windows Registry Set: Custom Protocol Handler DLL for CLSID {026CC6D7-34B2-33D5-B551-CA31EB6CE345}
Alerts when a Windows registry entry for a specific custom protocol handler CLSID is set to a DLL.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-04-23
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry value sets where the target key contains the specified CLSID server entry and the data ends with a DLL extension. Attackers may use custom protocol handler registrations to establish persistent execution via DLL loading. It relies on Windows registry set events that include the target object path and the written value details.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/registry_set_apt_forest_blizzard_custom_protocol_handler_dll.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-protocol-handler-clsid-server-dll-set-in-registry-d807056b
title: "Windows Registry Set: Custom Protocol Handler DLL for CLSID {026CC6D7-34B2-33D5-B551-CA31EB6CE345}"
id: 0b239cb6-e42e-45ff-9873-d7b871ee5a4a
status: test
description: This rule flags registry value sets where the target key contains the specified CLSID server entry and the data ends with a DLL extension. Attackers may use custom protocol handler registrations to establish persistent execution via DLL loading. It relies on Windows registry set events that include the target object path and the written value details.
references:
- https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/registry_set_apt_forest_blizzard_custom_protocol_handler_dll.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-23
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.001
- detection.emerging-threats
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \CLSID\{026CC6D7-34B2-33D5-B551-CA31EB6CE345}\Server
Details|endswith: .dll
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: d807056b-0e00-4cec-b7f8-b8b7518e382b
type: derived