{'created': '2017-05-31T21:30:42.222Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'When a file is opened, the default program used to open the '
                'file (also called the file association or handler) is '
                'checked. File association selections are stored in the '
                'Windows Registry and can be edited by users, administrators, '
                'or programs that have Registry access (Citation: Microsoft '
                'Change Default Programs) (Citation: Microsoft File Handlers) '
                'or by administrators using the built-in assoc utility. '
                '(Citation: Microsoft Assoc Oct 2017) Applications can modify '
                'the file association for a given file extension to call an '
                'arbitrary program when a file with the given extension is '
                'opened.\n'
                '\n'
                'System file associations are listed under '
                '<code>HKEY_CLASSES_ROOT\\.[extension]</code>, for example '
                '<code>HKEY_CLASSES_ROOT\\.txt</code>. The entries point to a '
                'handler for that extension located at '
                '<code>HKEY_CLASSES_ROOT\\[handler]</code>. The various '
                'commands are then listed as subkeys underneath the shell key '
                'at '
                '<code>HKEY_CLASSES_ROOT\\[handler]\\shell\\[action]\\command</code>. '
                'For example:\n'
                '* '
                '<code>HKEY_CLASSES_ROOT\\txtfile\\shell\\open\\command</code>\n'
                '* '
                '<code>HKEY_CLASSES_ROOT\\txtfile\\shell\\print\\command</code>\n'
                '* '
                '<code>HKEY_CLASSES_ROOT\\txtfile\\shell\\printto\\command</code>\n'
                '\n'
                'The values of the keys listed are commands that are executed '
                'when the handler opens the file extension. Adversaries can '
                'modify these values to continually execute arbitrary '
                'commands. (Citation: TrendMicro TROJ-FAKEAV OCT 2012)',
 'external_references': [{'external_id': 'T1042',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1042'},
                         {'external_id': 'CAPEC-556',
                          'source_name': 'capec',
                          'url': 'https://capec.mitre.org/data/definitions/556.html'},
                         {'description': 'Microsoft. (n.d.). Change which '
                                         'programs Windows 7 uses by default. '
                                         'Retrieved July 26, 2016.',
                          'source_name': 'Microsoft Change Default Programs',
                          'url': 'https://support.microsoft.com/en-us/help/18539/windows-7-change-default-programs'},
                         {'description': 'Microsoft. (n.d.). Specifying File '
                                         'Handlers for File Name Extensions. '
                                         'Retrieved November 13, 2014.',
                          'source_name': 'Microsoft File Handlers',
                          'url': 'http://msdn.microsoft.com/en-us/library/bb166549.aspx'},
                         {'description': 'Plett, C. et al.. (2017, October '
                                         '15). assoc. Retrieved August 7, '
                                         '2018.',
                          'source_name': 'Microsoft Assoc Oct 2017',
                          'url': 'https://docs.microsoft.com/windows-server/administration/windows-commands/assoc'},
                         {'description': 'Sioting, S. (2012, October 8). '
                                         'TROJ_FAKEAV.GZD. Retrieved August 8, '
                                         '2018.',
                          'source_name': 'TrendMicro TROJ-FAKEAV OCT 2012',
                          'url': 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_fakeav.gzd'}],
 'id': 'attack-pattern--68c96494-1a50-403e-8844-69a6af278c68',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'persistence'}],
 'modified': '2025-10-24T17:48:53.818Z',
 'name': 'Change Default File Association',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': True,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Stefan Kanthak', 'Travis Smith, Tripwire'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': False,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows'],
 'x_mitre_version': '1.1'}