Ms-Settings Shell Open Command Registry Modification
This rule detects modifications to specific registry keys associated with the 'ms-settings' URI scheme. Specifically, it looks for changes to the '(Default)' or 'DelegateExecute' values under 'ms-settings\Shell\Open\command'. Such modifications could indicate an attempt to hijack the 'ms-settings' URI handler to execute arbitrary commands or programs when a user tries to open Windows settings, potentially leading to persistence or privilege escalation.
Splunk (SPL)
