Windows: assoc.exe Changes File Extension Handler to exefile
Alerts on cmd.exe running assoc to set file extension handlers to exefile, indicating possible persistence via file associations.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-28
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions where assoc.exe is used to set a file extension’s default handler to exefile, causing files with that extension to open using an arbitrary executable. Such changes can enable persistence by redirecting user or system opens of common file types to attacker-controlled binaries. It relies on process creation telemetry including the executable image (cmd.exe) and the command line containing assoc operations that reference exefile mappings.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: assoc.exe Changes File Extension Handler to exefile"
id: 9b07c822-7a59-4211-a9e4-92bf240d46ea
related:
- id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061
type: derived
- id: ae6f14e6-14de-45b0-9f44-c0986f50dc89
type: derived
status: test
description: This rule identifies process executions where assoc.exe is used to set a file extension’s default handler to exefile, causing files with that extension to open using an arbitrary executable. Such changes can enable persistence by redirecting user or system opens of common file types to attacker-controlled binaries. It relies on process creation telemetry including the executable image (cmd.exe) and the command line containing assoc operations that reference exefile mappings.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_assoc_tamper_exe_file_association.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2023-03-06
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \cmd.exe
- OriginalFileName: Cmd.Exe
selection_cli:
CommandLine|contains|all:
- "assoc "
- exefile
filter:
CommandLine|contains: .exe=exefile
condition: all of selection_* and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1