File association handler rewritten to a script host or LOLBin

1title: File association handler rewritten to a script host or LOLBin2id: d3cf5408-f80e-4e07-b143-b9480b1c033a3status: experimental4description: |5  Matches the registry half of AN0170: the command that Windows runs when a file6  type is opened being set to an interpreter or a user-writable path. The handler7  lives at `<handler>\shell\<action>\command`, where `command` is a subkey and the8  command line sits in its default value, so a Sysmon EventID 13 record reads9  `...\shell\open\command\(Default)` — the terms therefore use `contains` and not10  `endswith`, and no hive prefix is matched because HKCR is a merged view that11  Sysmon never reports literally, writing instead `HKLM\SOFTWARE\Classes\...` or12  `HKU\<SID>_Classes\...`. The `Details` gate is MITRE's13  `SuspiciousHandlerPathRegex` knob, which names powershell.exe and rundll32.exe14  as examples and is populated here with the wider script-host and LOLBin set plus15  two user-writable directories; `\AppData\` as a whole is deliberately left out,16  since per-user installs of chat, editor and conferencing clients legitimately17  register handlers there and would swamp everything else. The execution half of18  the analytic — the hijacked handler spawning a child when a user opens a file —19  needs a correlation across MITRE's `TimeWindow` knob that Sigma cannot express,20  and Sysmon logs registry writes only for the paths its configuration allowlists,21  so confirm the Classes subtree is in yours before treating silence as clean.22  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0061, not hand-written and not tested by its author. Any lab result is on this rule's own page.23references:24  - https://attack.mitre.org/techniques/T1546/00125  - https://attack.mitre.org/detectionstrategies/DET006126author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)27date: 2026-08-1628tags:29  - attack.privilege-escalation30  - attack.persistence31  - attack.t1546.00132logsource:33  category: registry_set34  product: windows35detection:36  selection_command_value:37    TargetObject|contains:38      - '\shell\open\command'39      - '\shell\edit\command'40      - '\shell\print\command'41      - '\shell\printto\command'42      - '\shell\explore\command'43      - '\shell\runas\command'44  selection_handler:45    Details|contains:46      - 'powershell'47      - 'pwsh.exe'48      - 'cmd.exe'49      - 'wscript'50      - 'cscript'51      - 'mshta'52      - 'rundll32'53      - 'regsvr32'54      - 'certutil'55      - '\Users\Public\'56      - '\AppData\Local\Temp\'57  condition: selection_command_value and selection_handler58falsepositives:59  - "Windows setup, cumulative updates and the 'reset to the recommended defaults' apps operation, all of which rewrite the built-in handlers for script and control-panel file types. Those handlers genuinely name wscript.exe, mshta.exe and rundll32.exe — .vbs opens in WScript, .hta in mshta, .cpl and .inf through rundll32 — so this is the loudest source of matches and it arrives as a burst at image build time and after servicing."60  - "Application installers and MSI self-healing claiming an extension with a launcher that shells through cmd.exe or rundll32.exe, which rewrite the command value on every repair cycle rather than only at first install."61  - "Administrative baselines and Group Policy preferences that set associations fleet-wide, for instance forcing .ps1 and .vbs to open in an editor instead of executing, which writes a handler naming powershell.exe on every policy refresh."62  - "Portable applications and installers running from an extracted temporary directory that register their associations while still in that directory, producing a handler path under the user's Temp folder."63level: medium