Windows Process: File Association Changes via assoc Command
Alerts on cmd.exe launches running the assoc command to modify Windows default file associations.
- Product
- windows
- Category
- process_creation
- Author
- Timur Zinniatullin, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-21
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions of the built-in assoc utility by matching command lines containing "assoc" from cmd.exe. Changing file associations can allow an attacker to redirect how files open for a given extension, potentially enabling persistence or execution of arbitrary handlers. It relies on process creation telemetry including the executing image path and the full command line.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process: File Association Changes via assoc Command"
id: b977dbe6-aa49-41c6-9e48-a554bf6dd108
related:
- id: ae6f14e6-14de-45b0-9f44-c0986f50dc89
type: similar
- id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061
type: derived
status: test
description: This rule flags Windows process executions of the built-in assoc utility by matching command lines containing "assoc" from cmd.exe. Changing file associations can allow an attacker to redirect how files open for a given extension, potentially enabling persistence or execution of arbitrary handlers. It relies on process creation telemetry including the executing image path and the full command line.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.001/T1546.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_assoc_execution.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-03-06
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \cmd.exe
- OriginalFileName: Cmd.Exe
selection_cli:
CommandLine|contains: assoc
condition: all of selection_*
falsepositives:
- Admin activity
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_assoc_execution/info.yml
license: DRL-1.1