T1546.001 — Change Default File Association

Tactics: Privilege Escalation, Persistence · Platforms: Windows

Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.001 Event Triggered Execution: Change Default File Association

title: "T1546.001 Event Triggered Execution: Change Default File Association"
id: 9a18734f-4976-496b-9e44-33fe8180cbf9
description: 'Detect Default File Association Hijack via Registry Modification of ProgID shell open command handlers. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, SuspiciousHandlerPathRegex.'
references:
  - https://attack.mitre.org/techniques/T1546/001
author: Shahrukh Khan
date: 2026-02-09
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.001

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 13
    TargetObject|contains: '\shell\open\command'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate application installers registering file type handlers.

level: medium

Related sub-techniques

Explore