T1546.001 Event Triggered Execution: Change Default File Association

Adversaries may establish persistence by executing malicious content triggered by a file type association. MITRE ATT&CK

1 program on CmdID 3 Sigma rules T1546.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1546Event Triggered Execution

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highChange Default File Association To Executable Via AssocNasreddine Bencherchali (Nextron Systems) · Windows

mediumRegistry Modification of MS-settings Protocol Handlerfrack113, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

lowChange Default File Association Via AssocTimur Zinniatullin, oscd.community · Windows

everyday examples from tldr-pages, CC BY 4.0

To view the current file type association for the file name extension .txt, type on the page for assoc

assoc .txtIdentify

To remove the file type association for the file name extension .bak, type on the page for assoc

assoc .bak=Identify

To remove the file type association for the file name extension .jar, type on the page for assoc

assoc .jar=Identify

To view the output of assoc one screen at a time, type on the page for assoc

assoc | moreIdentify

To send the output of assoc to the file assoc.txt, type on the page for assoc

assoc>assoc.txtIdentify

Associate .log to text files on the page for assoc

assoc .log=txtfileIdentify

Associate files with no extension to text files on the page for assoc

assoc .=txtfileIdentify

List all associations between file extensions and file types on the page for assoc

Set the associated file type for a specific extension on the page for assoc

assoc .txt=txtfileIdentify

An example is here when CmdID’s reading of it names T1546.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.