{'created': '2020-01-24T13:40:47.282Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may establish persistence by executing malicious '
                'content triggered by a file type association. When a file is '
                'opened, the default program used to open the file (also '
                'called the file association or handler) is checked. File '
                'association selections are stored in the Windows Registry and '
                'can be edited by users, administrators, or programs that have '
                'Registry access or by administrators using the built-in assoc '
                'utility.(Citation: Microsoft Change Default '
                'Programs)(Citation: Microsoft File Handlers)(Citation: '
                'Microsoft Assoc Oct 2017) Applications can modify the file '
                'association for a given file extension to call an arbitrary '
                'program when a file with the given extension is opened.\n'
                '\n'
                'System file associations are listed under '
                '<code>HKEY_CLASSES_ROOT\\.[extension]</code>, for example '
                '<code>HKEY_CLASSES_ROOT\\.txt</code>. The entries point to a '
                'handler for that extension located at '
                '<code>HKEY_CLASSES_ROOT\\\\[handler]</code>. The various '
                'commands are then listed as subkeys underneath the shell key '
                'at '
                '<code>HKEY_CLASSES_ROOT\\\\[handler]\\shell\\\\[action]\\command</code>. '
                'For example: \n'
                '\n'
                '* '
                '<code>HKEY_CLASSES_ROOT\\txtfile\\shell\\open\\command</code>\n'
                '* '
                '<code>HKEY_CLASSES_ROOT\\txtfile\\shell\\print\\command</code>\n'
                '* '
                '<code>HKEY_CLASSES_ROOT\\txtfile\\shell\\printto\\command</code>\n'
                '\n'
                'The values of the keys listed are commands that are executed '
                'when the handler opens the file extension. Adversaries can '
                'modify these values to continually execute arbitrary '
                'commands.(Citation: TrendMicro TROJ-FAKEAV OCT 2012)',
 'external_references': [{'external_id': 'T1546.001',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1546/001'},
                         {'description': 'Microsoft. (n.d.). Change which '
                                         'programs Windows 7 uses by default. '
                                         'Retrieved July 26, 2016.',
                          'source_name': 'Microsoft Change Default Programs',
                          'url': 'https://support.microsoft.com/en-us/help/18539/windows-7-change-default-programs'},
                         {'description': 'Microsoft. (n.d.). Specifying File '
                                         'Handlers for File Name Extensions. '
                                         'Retrieved September 12, 2024.',
                          'source_name': 'Microsoft File Handlers',
                          'url': 'https://learn.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2015/extensibility/specifying-file-handlers-for-file-name-extensions?view=vs-2015'},
                         {'description': 'Plett, C. et al.. (2017, October '
                                         '15). assoc. Retrieved August 7, '
                                         '2018.',
                          'source_name': 'Microsoft Assoc Oct 2017',
                          'url': 'https://docs.microsoft.com/windows-server/administration/windows-commands/assoc'},
                         {'description': 'Sioting, S. (2012, October 8). '
                                         'TROJ_FAKEAV.GZD. Retrieved August 8, '
                                         '2018.',
                          'source_name': 'TrendMicro TROJ-FAKEAV OCT 2012',
                          'url': 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_fakeav.gzd'}],
 'id': 'attack-pattern--98034fef-d9fb-4667-8dc4-2eab6231724c',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'privilege-escalation'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'persistence'}],
 'modified': '2025-10-24T17:49:07.854Z',
 'name': 'Change Default File Association',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Travis Smith, Tripwire', 'Stefan Kanthak'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows'],
 'x_mitre_version': '1.1'}