ATT&CK technique
View on MITRE ATT&CK →
T1546.001
Change Default File Association
Privilege EscalationPersistence
7 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| sigma | Shell Open Registry Keys Manipulation | test | 2026-08-27 |
| splunk | Windows Change File Association Command To Notepad | production | 2026-05-13 |
| splunk | Windows New Default File Association Value Set | production | 2026-05-13 |
| sigma | Registry Modification of MS-settings Protocol Handler | test | 2026-01-24 |
| sigma | Suspicious Shell Open Command Registry Modification | experimental | 2026-01-24 |
| sigma | Change Default File Association To Executable Via Assoc | test | 2023-03-06 |
| sigma | Change Default File Association Via Assoc | test | 2023-03-06 |