// MITRE ATT&CK
T1546.001 · Change Default File Association
Sub-técnica de T1546 · Event Triggered Execution.
Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can...
¿Cómo detectarlo y mitigarlo?
La detección de Change Default File Association parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Técnicas relacionadas
T1546.013
PowerShell Profile T1546.006
LC_LOAD_DYLIB Addition T1548.002
Bypass User Account Control T1548.003
Sudo and Sudo Caching T1546.011
Application Shimming T1611
Escape to Host T1546.005
Trap T1548
Abuse Elevation Control Mechanism
PowerShell Profile T1546.006
LC_LOAD_DYLIB Addition T1548.002
Bypass User Account Control T1548.003
Sudo and Sudo Caching T1546.011
Application Shimming T1611
Escape to Host T1546.005
Trap T1548
Abuse Elevation Control Mechanism
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.