huntrule

Windows Process: File Association Changes via assoc Command

Alerts on cmd.exe launches running the assoc command to modify Windows default file associations.

FreeReviewedSigma · Low · v2
Product
windows
Category
process_creation
Author
Timur Zinniatullin, oscd.community (SigmaHQ), DRL 1.1
Published
2019-10-21
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process executions of the built-in assoc utility by matching command lines containing "assoc" from cmd.exe. Changing file associations can allow an attacker to redirect how files open for a given extension, potentially enabling persistence or execution of arbitrary handlers. It relies on process creation telemetry including the executing image path and the full command line.

Reporting behind it

Related detections4 linkedT1546.001 — drag to rearrange
TinyLoader Persistence via txtfile Shell Open Command Hijack (via registry_set)
Windows Registry: Alert on Changes to \shell\open\command Targeting Common Malware Paths
Windows: assoc.exe Changes File Extension Handler to exefile
Windows Registry and PowerShell Modification of ms-settings Protocol Handler
Windows Process: File Association Changes via assoc Command
Pivot detection · T1546.001 · 4 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.