Windows Registry Tampering: Attachment Manager Associations Default File Type Risk and LowRiskFileTypes

title: "Windows Registry Tampering: Attachment Manager Associations Default File Type Risk and LowRiskFileTypes"
id: a2ed953d-ed80-4920-ac1b-5595643e54fa
status: test
description: This rule identifies registry tampering under the Attachment Manager associations policy path by matching specific values for DefaultFileTypeRisk and LowRiskFileTypes. Attackers may reduce user visibility or security protections by altering how Windows classifies and handles file types associated with attachments. It relies on registry set telemetry capturing writes to TargetObject values and their associated DWORD/data contents.
references:
  - https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
  - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_policies_associations_tamper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-01
modified: 2023-08-17
tags:
  - attack.defense-impairment
logsource:
  category: registry_set
  product: windows
detection:
  selection_main:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\
  selection_value_default_file_type_rsik:
    TargetObject|endswith: \DefaultFileTypeRisk
    Details: DWORD (0x00006152)
  selection_value_low_risk_filetypes:
    TargetObject|endswith: \LowRiskFileTypes
    Details|contains:
      - .zip;
      - .rar;
      - .exe;
      - .bat;
      - .com;
      - .cmd;
      - .reg;
      - .msi;
      - .htm;
      - .html;
  condition: selection_main and 1 of selection_value_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47
    type: derived