Windows Registry Tampering: Attachment Manager Associations Default File Type Risk and LowRiskFileTypes
Flags Windows registry changes to Attachment Manager associations that set DefaultFileTypeRisk and modify LowRiskFileTypes.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-01
- Updated
- 2026-07-30
What it detects
This rule identifies registry tampering under the Attachment Manager associations policy path by matching specific values for DefaultFileTypeRisk and LowRiskFileTypes. Attackers may reduce user visibility or security protections by altering how Windows classifies and handles file types associated with attachments. It relies on registry set telemetry capturing writes to TargetObject values and their associated DWORD/data contents.
Reporting behind it
- support.microsoft.comhttps://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
- virustotal.comhttps://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_policies_associations_tamper.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-tampering-attachment-manager-associations-default-file-type-ris-a9b6c011
title: "Windows Registry Tampering: Attachment Manager Associations Default File Type Risk and LowRiskFileTypes"
id: a2ed953d-ed80-4920-ac1b-5595643e54fa
status: test
description: This rule identifies registry tampering under the Attachment Manager associations policy path by matching specific values for DefaultFileTypeRisk and LowRiskFileTypes. Attackers may reduce user visibility or security protections by altering how Windows classifies and handles file types associated with attachments. It relies on registry set telemetry capturing writes to TargetObject values and their associated DWORD/data contents.
references:
- https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
- https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_policies_associations_tamper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-01
modified: 2023-08-17
tags:
- attack.defense-impairment
logsource:
category: registry_set
product: windows
detection:
selection_main:
TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\
selection_value_default_file_type_rsik:
TargetObject|endswith: \DefaultFileTypeRisk
Details: DWORD (0x00006152)
selection_value_low_risk_filetypes:
TargetObject|endswith: \LowRiskFileTypes
Details|contains:
- .zip;
- .rar;
- .exe;
- .bat;
- .com;
- .cmd;
- .reg;
- .msi;
- .htm;
- .html;
condition: selection_main and 1 of selection_value_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47
type: derived