Windows Process Creation: Detect assoc Command Changing Default File Associations

title: "Windows Process Creation: Detect assoc Command Changing Default File Associations"
id: b977dbe6-aa49-41c6-9e48-a554bf6dd108
related:
  - id: ae6f14e6-14de-45b0-9f44-c0986f50dc89
    type: similar
  - id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061
    type: derived
status: test
description: This rule flags Windows process executions of cmd.exe where the command line includes the builtin "assoc" utility. It catches attempts to change default file associations for file extensions, which can redirect how files are opened and may support persistence. Detection relies on process creation telemetry, specifically the image name and the presence of "assoc" in the command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.001/T1546.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_assoc_execution.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-03-06
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cli:
    CommandLine|contains: assoc
  condition: all of selection_*
falsepositives:
  - Admin activity
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_assoc_execution/info.yml
license: DRL-1.1