Windows Registry Protocol Handler: CLSID Server DLL Set in Registry

title: "Windows Registry Protocol Handler: CLSID Server DLL Set in Registry"
id: 0b239cb6-e42e-45ff-9873-d7b871ee5a4a
status: test
description: This rule flags changes to a Windows registry key value ending with a DLL file for a specific custom protocol handler CLSID. Attackers can use custom protocol handlers for persistence and post-compromise execution by registering a DLL-backed handler. The detection relies on registry set telemetry that captures the TargetObject path and the Details value ending with “.dll”.
references:
  - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/registry_set_apt_forest_blizzard_custom_protocol_handler_dll.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-23
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \CLSID\{026CC6D7-34B2-33D5-B551-CA31EB6CE345}\Server
    Details|endswith: .dll
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: d807056b-0e00-4cec-b7f8-b8b7518e382b
    type: derived