{"id":"T1546.001","name":"Change Default File Association","url":"https://attack.mitre.org/techniques/T1546/001","tactics":["privilege-escalation","persistence"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0061","stix_id":"x-mitre-detection-strategy--61585647-dcc0-4c46-9333-c59796997826","name":"Detect Default File Association Hijack via Registry & Execution Correlation on Windows","url":"https://attack.mitre.org/detectionstrategies/DET0061","analytics":[{"id":"AN0170","stix_id":"x-mitre-analytic--3ac58f14-32d6-4ce2-8aa7-e7c429dd6405","name":"Analytic 0170","description":"Detects modification of registry keys used for default file handlers, followed by anomalous process execution from user-initiated file opens. This includes tracking changes under HKCU and HKCR for file extension mappings, and correlating them with new or suspicious handler paths launching unusual child processes (e.g., PowerShell, cmd, wscript).","url":"https://attack.mitre.org/detectionstrategies/DET0061#AN0170","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4672","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"TimeWindow","description":"Defines how long after the registry modification to correlate a suspicious process execution"},{"field":"UserContext","description":"Tune to ignore known admin or installer behavior in specific user profiles"},{"field":"SuspiciousHandlerPathRegex","description":"Pattern match for suspicious handler paths (e.g., powershell.exe, rundll32.exe)"}],"live":true,"detection_strategies":["DET0061"],"techniques":["T1546.001"]}],"live":true,"version":"1.0","techniques":["T1546.001"]}],"sigma_rules":[{"id":"152f3630-77c1-4284-bcc0-4cc68ab2f6e7","title":"Shell Open Registry Keys Manipulation","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2022-01-13","description":"Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)","references":["https://github.com/hfiref0x/UACME","https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/","https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass","https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021]"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1548.002","attack.t1546.001"],"path":"rules/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml","techniques":["T1548.002","T1546.001"],"cves":[]},{"id":"3d3aa6cd-6272-44d6-8afc-7e88dfef7061","title":"Change Default File Association Via Assoc","author":"Timur Zinniatullin, oscd.community","status":"test","level":"low","date":"2019-10-21","modified":"2023-03-06","description":"Detects file association changes using the builtin \"assoc\" command.\nWhen a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.001/T1546.001.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1546.001"],"path":"rules/windows/process_creation/proc_creation_win_cmd_assoc_execution.yml","techniques":["T1546.001"],"cves":[]},{"id":"9e8894c0-0ae0-11ef-9d85-1f2942bec57c","title":"Suspicious Shell Open Command Registry Modification","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-01-24","modified":null,"description":"Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence.\nGenerally, modifications to the `*\\shell\\open\\command` registry key can indicate an attempt to change the default action for opening files,\nand various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries.\n","references":["https://www.trendmicro.com/en_us/research/25/f/water-curse.html"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1548.002","attack.t1546.001"],"path":"rules/windows/registry/registry_set/registry_set_susp_shell_open_keys_modification_patterns.yml","techniques":["T1548.002","T1546.001"],"cves":[]},{"id":"ae6f14e6-14de-45b0-9f44-c0986f50dc89","title":"Change Default File Association To Executable Via Assoc","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2023-03-06","description":"Detects when a program changes the default file association of any extension to an executable.\nWhen a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.\n","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1546.001"],"path":"rules/windows/process_creation/proc_creation_win_cmd_assoc_tamper_exe_file_association.yml","techniques":["T1546.001"],"cves":[]},{"id":"dd3ee8cc-f751-41c9-ba53-5a32ed47e563","title":"Registry Modification of MS-settings Protocol Handler","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2021-12-20","modified":"2026-01-24","description":"Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence.\nAttackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.\n","references":["https://thedfirreport.com/2021/12/13/diavol-ransomware/","https://www.trendmicro.com/en_us/research/25/f/water-curse.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.defense-impairment","attack.t1548.002","attack.t1546.001","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_susp_registry_modification_of_ms_setting_protocol_handler.yml","techniques":["T1548.002","T1546.001","T1112"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}