Skip to content

Instantly share code, notes, and snippets.

View AlloySecureGroup's full-sized avatar

Alloy Secure Group AlloySecureGroup

View GitHub Profile
@AlloySecureGroup
AlloySecureGroup / Enumerate-UrlSchemes.ps1
Last active July 12, 2026 19:34
Scheme Hunter - Enumerate URI schemes and prototype invocation
<#
.SYNOPSIS
Enumerates all registered URI/URL protocol handlers ("schemes") on a
Windows endpoint and statically risk-scores them for potential
execution-primitive abuse (cf. search-ms:, ms-officecmd:, and similar
scheme-hijack findings).
.DESCRIPTION
Does NOT invoke any handler. Purely reads HKEY_CLASSES_ROOT and
HKEY_CURRENT_USER\Software\Classes for keys that carry the