Suspicious Registry Modification for MS-Settings DelegateExecute
This rule detects suspicious modifications to the Windows Registry related to the 'ms-settings' URI scheme, specifically targeting the 'DelegateExecute' value or the default value of 'HKCU\Software\Classes\ms-settings\Shell\Open\Command'. This technique can be used by adversaries to hijack the execution of applications launched via the 'ms-settings' URI, potentially leading to arbitrary code execution or privilege escalation. The rule also includes a detection for the deletion of the 'ms-settings' key, which could be an attempt to clean up after such an attack.
Sigma
