Search-MS URI Scheme is a Windows URI scheme that launches the system search experience with a query or search target. It uses registered URI handlers so links like search-ms: can open local or network search results, and it is sometimes abused to deliver deceptive files or shortcuts through crafted links.
What the Search-MS URI Scheme Does
The search-ms URI scheme is a Windows launcher for the built-in search experience. It can open local or network search results directly from a link, which makes it useful for shortcuts and deep links, but also means the invocation itself can hide where the search target really lives.
Its security significance is less about the search interface and more about trust: a user may see a harmless-looking link while the handler resolves to a file, folder, or share that was not obvious at first glance. That gap between the visible link and the actual destination is what attackers try to exploit.
Why It Is Abused in Deceptive Delivery
Crafted search-ms links can be used to make malicious content look like an ordinary Windows search result. In practice, that can help disguise a payload, shortcut, or remote location inside a familiar system workflow, reducing the chance that a user questions the file path or origin.
Because the scheme relies on registered URI handlers, the risk is not limited to the literal link text. The operating system decides what to do with the URI, so the user experience can be shaped by whatever the handler resolves, not just by what was visible in email, chat, or a web page.
This is one reason URL and shortcut handling deserves the same attention as attachments: the attack path is often social, but the consequence is still execution or exposure through a trusted desktop feature. For a broader identity and trust perspective on how deceptive access paths are abused, see WIMSE Workload Identity Architecture Guide for a related discussion of trust boundaries and tokenized access.
How Organisations Assess Exposure and Reduce Misuse
Exposure starts with knowing where search-ms links can arrive and how Windows endpoints handle them. Security teams should review email security, browser handling, endpoint policy, and any applications that generate or forward URI-based links, then determine whether users can be steered into opening remote content without obvious cues.
Defensive review should also look at whether network shares, downloadable content, or file staging locations are reachable through links that appear local. The question is not whether the scheme is legitimate, but whether the organisation permits it to become a delivery vector for deceptive navigation.
For Windows environments, this is a control-governance issue as much as a user-awareness issue: deep links should be treated as potentially executable navigation, not as inert text. NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful reference point for tying this to access control, configuration management, and system integrity expectations.
Detection, Investigation, and Post-Click Review
Detection focus should be on the surrounding delivery chain, not just the URI string itself. Suspicious messages, unexpected link destinations, sudden launches of search windows, and follow-on file access from unusual processes can all indicate abuse of the scheme.
When a user has interacted with a suspicious search-ms link, responders should review browser history, email or chat provenance, endpoint process creation, and any file or shortcut that was opened afterward. If the link led to a remote resource, the investigation should extend to the related share, host, or download location.
Where the event is part of a broader intrusion, correlate it with adjacent technique patterns such as deceptive file delivery, shortcut abuse, and user-assisted execution. The MITRE ATT&CK Enterprise Matrix is useful for mapping those follow-on behaviours into a larger attack path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | Search-ms abuse can steer users into unintended access paths and remote content. |
| CM-7 — Least Functionality | Limiting unnecessary URI handlers reduces the attack surface for deceptive links. | |
| SI-3 — Malicious Code Protection | Deceptive link delivery often precedes payload execution and harmful file access. | |
| Recommendation — Enforce access rules for URI-triggered content and restrict unintended network or file access paths. Disable or constrain URI handlers and related launch paths that are not required for business use. Inspect and block malicious link-based delivery before users reach the payload. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Search-ms links are commonly delivered through messaging and browser workflows. |
| Recommendation — Filter suspicious links and harden browser and email handling of external URI launches. | ||
| MITRE ATT&CK | T1204 — User Execution | The scheme relies on user interaction to trigger the deceptive launch path. |
| Recommendation — Hunt for user-assisted execution that starts from crafted links or prompts. | ||
Practitioner Guidance
What to watch for: Treat search-ms as a trust-boundary issue, not a convenience feature. If users frequently receive links that launch search results, the important question is whether the link obscures the true file origin or location enough to support deception.
Governance implication: Security teams should define when URI-based launches are acceptable, how they are filtered or warned on, and what endpoint or messaging controls are expected when they are used to reach external or network content. That keeps the decision anchored in policy rather than left to ad hoc user judgment.
Practitioner takeaway: The safest stance is to assume a search-ms link can be a delivery wrapper, then validate the destination and the surrounding context before allowing it to influence user trust or endpoint execution.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org