Windows: Detect assoc.exe Changing File Associations to exefile

title: "Windows: Detect assoc.exe Changing File Associations to exefile"
id: 9b07c822-7a59-4211-a9e4-92bf240d46ea
related:
  - id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061
    type: derived
  - id: ae6f14e6-14de-45b0-9f44-c0986f50dc89
    type: derived
status: test
description: This rule flags process executions where assoc is used to set a file extension’s handler to exefile, effectively mapping files to run an executable when opened. Attackers may abuse file associations for persistence or to execute arbitrary programs via normal file open behavior. It relies on Windows process creation telemetry, specifically the image path for cmd.exe and the command line containing assoc space exefile, excluding commands that include the explicit .exe=exefile pattern.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_assoc_tamper_exe_file_association.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2023-03-06
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cli:
    CommandLine|contains|all:
      - "assoc "
      - exefile
  filter:
    CommandLine|contains: .exe=exefile
  condition: all of selection_* and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1