Potential Persistence Via Custom Protocol Handler
Detects potential persistence activity by monitoring the registration of new custom protocol handlers in the Windows Registry. Attackers can abuse this mechanism to establish persistence by setting a custom handler to execute malicious code when a specific URI scheme is accessed. The rule filters out common legitimate Microsoft protocols and applications installed in standard program file locations to reduce false positives.
Sigma
