{"id":"fdbf0b9d-0182-4c43-893b-a1eaab92d085","title":"Potential Persistence Via Custom Protocol Handler","description":"Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-05-30","modified":"2023-05-12","tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1112"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Many legitimate applications can register a new custom protocol handler. Additional filters needs to applied according to your environment."],"references":["https://ladydebug.com/blog/2019/06/21/custom-protocol-handler-cph/"],"source_path":"rules/windows/registry/registry_set/registry_set_persistence_custom_protocol_handler.yml","source_sha256":"847940f86b266d5c7a8cda9651ae5c083aba227c129b1139d7494b66c2bb8cfc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_custom_protocol_handler.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Persistence Via Custom Protocol Handler\nid: fdbf0b9d-0182-4c43-893b-a1eaab92d085\nstatus: test\ndescription: Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.\nreferences:\n    - https://ladydebug.com/blog/2019/06/21/custom-protocol-handler-cph/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-05-30\nmodified: 2023-05-12\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|startswith: 'HKCR\\'\n        Details|startswith: 'URL:'\n    filter_main_ms_trusted:\n        Details|startswith: 'URL:ms-' # Microsoft Protocols usually start with \"ms-\"\n    filter_main_generic_locations:\n        Image|startswith: # Add more folders to avoid FP\n            - 'C:\\Program Files (x86)'\n            - 'C:\\Program Files\\'\n            - 'C:\\Windows\\System32\\'\n            - 'C:\\Windows\\SysWOW64\\'\n    # Uncomment This section to add specific Protocol Handler names that are know\n    # filter_specific:\n    #     Details: 'URL:'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Many legitimate applications can register a new custom protocol handler. Additional filters needs to applied according to your environment.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/fdbf0b9d-0182-4c43-893b-a1eaab92d085.json","kind":"sigma"}