Threat intelligence / Mitigation

Change Default File Association Mitigation

Direct mitigation of this technique is not recommended since it is a legitimate function that can be performed by users for software preferences. Follow Microsoft's best practices for file associations. (Citation: MSDN File Associations) Identify and block potentially malicious software that may be executed by this technique using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Mitigation

TypeMitigation

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Direct mitigation of this technique is not recommended since it is a legitimate function that can be performed by users for software preferences. Follow Microsoft's best practices for file associations. (Citation: MSDN File Associations) Identify and block potentially malicious software that may be executed by this technique using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

0 recorded

Relationships

No relationships recorded.

7 external

References

mitre-attack

T1042

MSDN File Associations

https://msdn.microsoft.com/en-us/library/cc144156.aspx

Beechey 2010

http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599

Windows Commands JPCERT

http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html

NSA MS AppLocker

https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm

Corio 2008

http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx

TechNet Applocker vs SRP

https://technet.microsoft.com/en-us/library/ee791851.aspx