Persistence via Locked:// custom protocol handler registration

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•6

Detects suspicious modifications to Windows Registry keys associated with URL protocol handlers or automatic startup mechanisms. Adversaries often use custom URL schemes or registry run keys to maintain persistence or execute malicious code when a specific protocol is invoked or upon user logon.