Potential Persistence Via Custom Protocol Handler (fdbf0b9d-0182-4c43-893b-a1eaab92d085)
Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) | Attack Pattern | Potential Persistence Via Custom Protocol Handler (fdbf0b9d-0182-4c43-893b-a1eaab92d085) | Sigma-Rules | 1 |