Manipulation of default file extension configuration

BIOC Low

Manipulation of default file extension configuration

Alerts when a handler of a known file extension is modified. Applicable to EXE, DLL, SYS, PS1, BAT, CMD, ZIP and LNK extensions.

Module:: Platform Analytics
Agent event type:: Registry
Category:: Tampering
Status:: Enabled

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Event Triggered Execution: Change Default File Association (T1546.001)

Indicator:

Registry registry value name = .exe , .dll , .sys , .lnk , .ps1 , .rar , .cmd , .bat , .zip AND registry key name = *\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\* AND action type = set_registry_value Host host os = windows

Preventable: yes