Change Default File Association (T1042)

View on ATT&CK

In Playbook

Technique & Subtechniques

  • Change Default File Association

Associated Tactics

  • Persistence

Persistence (TA0003)

The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

View on ATT&CK

Procedure Examples

Description Source(s)
capec
Microsoft. (n.d.). Change which programs Windows 7 uses by default. Retrieved July 26, 2016. Microsoft Change Default Programs
Microsoft. (n.d.). Specifying File Handlers for File Name Extensions. Retrieved November 13, 2014. Microsoft File Handlers
Plett, C. et al.. (2017, October 15). assoc. Retrieved August 7, 2018. Microsoft Assoc Oct 2017
Sioting, S. (2012, October 8). TROJ_FAKEAV.GZD. Retrieved August 8, 2018. TrendMicro TROJ-FAKEAV OCT 2012