Change Default File Association (MITRE ATT&CK T1546.001) is a Windows persistence and privilege escalation technique. When a file is opened, Windows checks which program is the default handler for its type. Those choices live in the registry and can be edited by users, administrators or programs with registry access, or with the built-in assoc utility.
How attackers use it
System file associations sit under HKEY_CLASSES_ROOT\.[extension], which point to a handler at HKEY_CLASSES_ROOT\[handler]. The commands run for each action are subkeys under shell, such as HKEY_CLASSES_ROOT\txtfile\shell\open\command. Print and printto work the same way.
MITRE says adversaries can modify those command values to run arbitrary commands each time a file of that type is handled.
How to detect it
- Changes to registry keys used for file handlers, under HKCU and HKCR.
- New or unusual handler paths that launch odd child processes after a user opens a file, such as PowerShell, cmd or wscript.
How to reduce the risk
MITRE lists no specific mitigations for this sub-technique. Monitor handler keys, limit registry write rights, and treat a handler that launches a script host as suspicious.
Quick check
Where do the commands for a file type's open action live?
Under the shell subkey of the handler, for example HKEY_CLASSES_ROOT\txtfile\shell\open\command.
