Windows Registry New File Association via exefile Handler (Classes\*.exefile)
Alerts on Windows registry changes creating a new file association that points to the exefile handler.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Andreas Hunkeler (@Karneades) (SigmaHQ), DRL 1.1
- Published
- 2021-11-19
- Updated
- 2026-07-30
What it detects
This rule flags registry set activity where a new file association maps to the exefile handler under Classes\*. It matters because attackers can register or modify file handlers to execute trusted-looking programs and potentially bypass security tooling. The detection relies on telemetry from Windows registry value updates that include TargetObject paths containing Classes\. and Details set to exefile.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-new-file-association-via-exefile-handler-classes-exefile-44a22d59
title: Windows Registry New File Association via exefile Handler (Classes\*.exefile)
id: 545d3b71-5839-4ebb-b107-b01258185fc0
status: test
description: This rule flags registry set activity where a new file association maps to the exefile handler under Classes\*. It matters because attackers can register or modify file handlers to execute trusted-looking programs and potentially bypass security tooling. The detection relies on telemetry from Windows registry value updates that include TargetObject paths containing Classes\. and Details set to exefile.
references:
- https://twitter.com/mrd0x/status/1461041276514623491
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_file_association_exefile.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2021-11-19
modified: 2023-08-17
tags:
- attack.stealth
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: Classes\.
Details: exefile
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 44a22d59-b175-4f13-8c16-cbaef5b581ff
type: derived