Registry Modification of MS-settings Protocol Handler

Severity: medium
Author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems)
Source: upstream

Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence. Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry, `T1546.001` Event Triggered Execution: Change Default File Association
Privilege Escalation	`T1546.001` Event Triggered Execution: Change Default File Association, `T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control
Defense Evasion	`T1112` Modify Registry, `T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_reg_img`

or:
Image|endswith: '\reg.exe'
OriginalFileName: reg.exe

Stage 2: `all of selection_reg_cli`

CommandLine|contains: add

Stage 3: `all of selection_pwsh_img`

or:
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'
OriginalFileName: powershell.exe
OriginalFileName: pwsh.dll

Stage 4: `all of selection_pwsh_cli`

or:
CommandLine|contains: New-ItemProperty
CommandLine|contains: Set-ItemProperty
CommandLine|contains: 'ni '
CommandLine|contains: 'sp '

Stage 5: `selection_cli_key`

CommandLine|contains: '\ms-settings\shell\open\command'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`New-ItemProperty` corpus 4 (sigma 4) `Set-ItemProperty` corpus 4 (sigma 4) `\ms-settings\shell\open\command` `add` corpus 16 (sigma 16) `ni` corpus 2 (sigma 2) `sp` corpus 2 (sigma 2)
`Image`	ends_with	`\powershell.exe` corpus 143 (sigma 143) `\pwsh.exe` corpus 140 (sigma 140) `\reg.exe` corpus 46 (sigma 46)
`OriginalFileName`	eq	`powershell.exe` corpus 8 (sigma 8) `pwsh.dll` corpus 72 (sigma 68, splunk 4) `reg.exe` corpus 29 (sigma 29)

Registry Modification of MS-settings Protocol Handler

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_reg_img

Stage 2: all of selection_reg_cli

Stage 3: all of selection_pwsh_img