Find MIME Sniffing Protocol Filters in Regedit

This article explains how to locate and inspect the registered system-wide protocol filters and MIME sniffing configurations within the Windows Registry. Administrators, security researchers, and developers can inspect these registry keys to understand how Windows components, such as urlmon.dll, analyze data streams, negotiate content types, and intercept web traffic.

Primary Registry Path for Protocol Filters

System-wide asynchronous pluggable protocol filters used for MIME handling are registered under the following key:

HKEY_CLASSES_ROOT\PROTOCOLS\Filter

Because HKEY_CLASSES_ROOT is a merged view of machine-wide and user-specific configurations, you can also inspect the explicit system-wide registration directly at:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter

For 32-bit applications running on a 64-bit Windows installation, inspect the WOW6432Node counterpart:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\PROTOCOLS\Filter

Understanding the Filter Entries

Under the Filter key, each subkey corresponds to a registered MIME type (such as text/xml, text/html, application/octet-stream, or custom protocols).

Each MIME type subkey typically contains: * CLSID: A String value (REG_SZ) containing the Class Identifier (GUID) of the COM object that implements the IInternetProtocol or IInternetProtocolSink interface to process or sniff that specific data type.

Inspecting the MIME Database for Content-Type Sniffing

To see how Windows defines sniffing behavior, file extensions, and associated binary signatures (magic bytes) for MIME types, navigate to the MIME database:

HKEY_CLASSES_ROOT\MIME\Database\Content Type

or the direct system path:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type

Key values within specific Content Type subkeys include: * CLSID: The COM component associated with the MIME type. * Extension: The default file extension mapped to the MIME type. * Bits: Binary signatures used by the system’s MIME sniffing algorithm to detect the file format from the first few bytes of a data stream.

Steps to Inspect in Regedit

  1. Press Win + R, type regedit, and press Enter.
  2. Paste HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter into the address bar at the top of the Registry Editor.
  3. Select any listed MIME subkey to view the associated CLSID handling the protocol filter.
  4. To verify the filter’s backing DLL, copy the GUID from the CLSID value, navigate to HKEY_CLASSES_ROOT\CLSID\{YOUR-GUID-HERE}\InprocServer32, and inspect the (Default) value to see the executing binary.