huntrule

Windows Registry New File Association via exefile Handler (Classes\*.exefile)

Alerts on Windows registry changes creating a new file association that points to the exefile handler.

FreeUnreviewedSigmahighv1
title: Windows Registry New File Association via exefile Handler (Classes\*.exefile)
id: 545d3b71-5839-4ebb-b107-b01258185fc0
status: test
description: This rule flags registry set activity where a new file association maps to the exefile handler under Classes\*. It matters because attackers can register or modify file handlers to execute trusted-looking programs and potentially bypass security tooling. The detection relies on telemetry from Windows registry value updates that include TargetObject paths containing Classes\. and Details set to exefile.
references:
  - https://twitter.com/mrd0x/status/1461041276514623491
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_file_association_exefile.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2021-11-19
modified: 2023-08-17
tags:
  - attack.stealth
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: Classes\.
    Details: exefile
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 44a22d59-b175-4f13-8c16-cbaef5b581ff
    type: derived

What it detects

This rule flags registry set activity where a new file association maps to the exefile handler under Classes\*. It matters because attackers can register or modify file handlers to execute trusted-looking programs and potentially bypass security tooling. The detection relies on telemetry from Windows registry value updates that include TargetObject paths containing Classes\. and Details set to exefile.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.