Per-User Handler Commands
Per-user handler commands under Software\Classes that normally should not exist.
Use it to spot a per-user protocol or file handler command, a known sign of a UAC bypass attempt.
- UsrClass.dat
- Defence Evasion
What It Is
Software\Classes holds file associations and other class registrations, which tell Windows which program handles each type of item. Windows keeps one copy for all users under HKEY_LOCAL_MACHINE and one per user under HKEY_CURRENT_USER, and the user's settings have priority over the machine's. Under a class, the value in shell\open\command is the command line Windows runs for the open verb, the action behind opening the item. The per-user copy lives in the user's classes registry file, UsrClass.dat, in AppData\Local\Microsoft\Windows.
What It Proves
A per-user shell\open\command for a handler such as ms-settings or mscfile is abnormal, because the machine handler carries the command and users do not normally override it. The value names what would run.
What It Does Not Prove
It shows an unexpected command is registered, not that it ran. A few applications register per-user handlers legitimately, so judge the target, not just the key.
Where It Lives
Per-User Handler Commands lives in the UsrClass.dat hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
UsrClass.dat\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Here a per-user ms-settings command points at a user Temp folder. There is no legitimate reason for this override, so remove it and find what run |
| The ms-settings handler is redirected to another class, a variant of the same trick. Read the target class and treat the override as suspicious. |
| A per-user mscfile handler launching a hidden shell. Remove it, and review PowerShell and process-start events around the key write time. |
How to Read It
Look under each user's Software\Classes for handlers such as ms-settings, mscfile and exefile with a shell\open\command or CurVer. Read the command data. A shell, a script host or a path in a user-writable folder is the signal. To put it right, remove the per-user override. Then check what ran at the matching time in event 4688 in the Security log, where Audit Process Creation is on.
- When Windows Writes It
- It changes when a value is set in a user's hive. These keys do not normally carry a per-user command.
- Which Windows Versions
- Windows 7 to 11
- Tools That Parse It
- Registry Explorer, RECmd, Autoruns
Hunt It
Defender records these writes and shows the user Classes hive as HKEY_CURRENT_USER\<SID>_Classes, with the default value as an empty name. A hit under ms-settings or mscfile shows a command registered, not that it ran.
// Per-user handler command writtenDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Per-User Handler Commands shows.
- Process Starts, Security Event 4688Not in the RegistryShows whether the command this handler names actually ran, and when.
- Registry Value Set, Sysmon Event 13Not in the RegistryDates when the handler was written, and names the process that wrote it.
Sources
The facts on this page come from these public pages, which say more on each point.
- MITRE ATT&CK T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control (opens in a new tab)
- Microsoft Learn: Sysinternals Autoruns (opens in a new tab)
- Microsoft Learn: HKEY_CLASSES_ROOT key (opens in a new tab)
- Microsoft Learn: verbs and file associations (opens in a new tab)
- Microsoft Learn: profile loading fails (where UsrClass.dat is kept) (opens in a new tab)