File association handler rewritten to a script host or LOLBin

Siemphony@siemphonymediumT1546.001unverified

Matches the registry half of AN0170: the command that Windows runs when a file type is opened being set to an interpreter or a user-writable path. The handler lives at `<handler>\shell\<action>\command`, where `command` is a subkey and the command line sits in its default value, so a Sysmon EventID 13 record reads `...\shell\open\command\(Default)` — the terms therefore use `contains` and not `endswith`, and no hive prefix is matched because HKCR is a merged view that Sysmon never reports literally, writing instead `HKLM\SOFTWARE\Classes\...` or `HKU\<SID>_Classes\...`. The `Details` gate is MITRE's `SuspiciousHandlerPathRegex` knob, which names powershell.exe and rundll32.exe as examples and is populated here with the wider script-host and LOLBin set plus two user-writable directories; `\AppData\` as a whole is deliberately left out, since per-user installs of chat, editor and conferencing clients legitimately register handlers there and would swamp everything else. The execution half of the analytic — the hijacked handler spawning a child when a user opens a file — needs a correlation across MITRE's `TimeWindow` knob that Sigma cannot express, and Sysmon logs registry writes only for the paths its configuration allowlists, so confirm the Classes subtree is in yours before treating silence as clean. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0061, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where ((RegistryKey contains "\\shell\\open\\command" or RegistryKey contains "\\shell\\edit\\command" or RegistryKey contains "\\shell\\print\\command" or RegistryKey contains "\\shell\\printto\\command" or RegistryKey contains "\\shell\\explore\\command" or RegistryKey contains "\\shell\\runas\\command") and (RegistryValueData contains "powershell" or RegistryValueData contains "pwsh.exe" or RegistryValueData contains "cmd.exe" or RegistryValueData contains "wscript" or RegistryValueData contains "cscript" or RegistryValueData contains "mshta" or RegistryValueData contains "rundll32" or RegistryValueData contains "regsvr32" or RegistryValueData contains "certutil" or RegistryValueData contains "\\Users\\Public\\" or RegistryValueData contains "\\AppData\\Local\\Temp\\"))

Splunk · SPL

Run this as a search.

index=* ((TargetObject="*\\shell\\open\\command*" OR TargetObject="*\\shell\\edit\\command*" OR TargetObject="*\\shell\\print\\command*" OR TargetObject="*\\shell\\printto\\command*" OR TargetObject="*\\shell\\explore\\command*" OR TargetObject="*\\shell\\runas\\command*") AND (Details="*powershell*" OR Details="*pwsh.exe*" OR Details="*cmd.exe*" OR Details="*wscript*" OR Details="*cscript*" OR Details="*mshta*" OR Details="*rundll32*" OR Details="*regsvr32*" OR Details="*certutil*" OR Details="*\\Users\\Public\\*" OR Details="*\\AppData\\Local\\Temp\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(registry.path) LIKE "*\\\\shell\\\\open\\\\command*" OR TO_LOWER(registry.path) LIKE "*\\\\shell\\\\edit\\\\command*" OR TO_LOWER(registry.path) LIKE "*\\\\shell\\\\print\\\\command*" OR TO_LOWER(registry.path) LIKE "*\\\\shell\\\\printto\\\\command*" OR TO_LOWER(registry.path) LIKE "*\\\\shell\\\\explore\\\\command*" OR TO_LOWER(registry.path) LIKE "*\\\\shell\\\\runas\\\\command*") AND (TO_LOWER(registry.data.strings) LIKE "*powershell*" OR TO_LOWER(registry.data.strings) LIKE "*pwsh.exe*" OR TO_LOWER(registry.data.strings) LIKE "*cmd.exe*" OR TO_LOWER(registry.data.strings) LIKE "*wscript*" OR TO_LOWER(registry.data.strings) LIKE "*cscript*" OR TO_LOWER(registry.data.strings) LIKE "*mshta*" OR TO_LOWER(registry.data.strings) LIKE "*rundll32*" OR TO_LOWER(registry.data.strings) LIKE "*regsvr32*" OR TO_LOWER(registry.data.strings) LIKE "*certutil*" OR TO_LOWER(registry.data.strings) LIKE "*\\\\users\\\\public\\\\*" OR TO_LOWER(registry.data.strings) LIKE "*\\\\appdata\\\\local\\\\temp\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)(\\shell\\open\\command|\\shell\\edit\\command|\\shell\\print\\command|\\shell\\printto\\command|\\shell\\explore\\command|\\shell\\runas\\command)</field>    <field name="Details" type="pcre2">(?i)(powershell|pwsh\.exe|cmd\.exe|wscript|cscript|mshta|rundll32|regsvr32|certutil|\\Users\\Public\\|\\AppData\\Local\\Temp\\)</field>    <description>File association handler rewritten to a script host or LOLBin</description>    <mitre>      <id>T1546.001</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d3cf5408-f80e-4e07-b143-b9480b1c033a

ATT&CKT1546.001

T1546.001Change Default File Association

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AN0170 describes two stages: a registry write that changes a file association's handler command, then a user opening that file type and the hijacked handler spawning an unusual child process. This rule covers only the first stage — a single Sysmon EventID 13 write to a shell\<verb>\command key. A hit means a file-open command was rewritten to something suspicious; it does not mean anyone has opened the file yet. Sigma has no way to chain that to the process-creation half, so the second stage is out of reach here.

02 · Telemetry you need

Sysmon EventID 13 as category: registry_set / product: windows. Sysmon's registry logging is allowlist-driven by its own configuration — if the Classes subtree isn't in that allowlist, this rule returns nothing, and that silence means "not collected," not "clean." Per translations.json, Splunk, Elastic ESQL, and Wazuh all render this query; Sentinel refuses outright because it has no table modelled for the registry_set logsource.

03 · How the logic works

Two ANDed selections. selection_command_value matches TargetObject|contains against six shell verbs — open, edit, print, printto, explore, runas — each written as \shell\<verb>\command. contains, not endswith, is deliberate: the command line is the key's default value, so Sysmon actually logs ...\shell\open\command\(Default), with the verb string sitting in the middle of the path, not at its end. An endswith anchor would never fire. No hive prefix is matched either, because HKEY_CLASSES_ROOT is a merged view Sysmon never reports literally — it writes HKLM\SOFTWARE\Classes\... or HKU\<SID>_Classes\... instead, and contains absorbs both. selection_handler checks Details|contains against MITRE's SuspiciousHandlerPathRegex knob. MITRE's description only names powershell.exe and rundll32.exe as examples; the author widened this to the fuller script-host/LOLBin set (pwsh.exe, cmd.exe, wscript, cscript, mshta, regsvr32, certutil) plus two user-writable path fragments, \Users\Public\ and \AppData\Local\Temp\. Note what's deliberately absent: \AppData\ as a whole is left out of the path list, because legitimate per-user installs of chat, editor, and conferencing clients register handlers there constantly.

04 · Common false positives

The loudest source is stock Windows behavior, not attacker activity: Windows setup, cumulative updates, and the "reset to recommended defaults" flow all rewrite built-in handlers that genuinely name wscript.exe (.vbs), mshta.exe (.hta), and rundll32.exe (.cpl/.inf) — arriving as a burst at image build time or right after servicing. Behind that: MSI self-healing rewriting a claimed extension's command through cmd.exe/rundll32.exe on every repair cycle, GPO baselines forcing .ps1/.vbs to open in an editor (naming powershell.exe on every policy refresh), and portable apps registering associations while still running from a Temp extraction path.
The sharper limitation is what the review flagged: Details|contains is substring matching on a value-data field, and it is a floor, not a ceiling. Rename or copy powershell.exe to any filename that doesn't contain the listed substrings, point the handler at that copy, and the rule never fires — no CommandLine-style parent/child correlation is available on a registry_set event to catch it another way. This isn't a rule defect so much as the ceiling of what this logsource can express; treat every match as "a known name was used," not "no interpreter was used."

05 · Detection maturity

tier_1: .** Machine-derived from a MITRE scaffold with no query logic behind it, and never executed against a log line. The rename evasion above was found by static review, not observed hit volume — it says nothing about how often this fires in practice, which stays unknown until it runs read-only against real registry activity.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude known servicing windows and MSI repair GUIDs if the noise from
Do not tighten Details|contains further hoping to fully close the rename
Keep \AppData\ off the path list unless you're prepared to tune out

Declared by the author

Windows setup, cumulative updates and the 'reset to the recommended defaults' apps operation, all of which rewrite the built-in handlers for script and control-panel file types. Those handlers genuinely name wscript.exe, mshta.exe and rundll32.exe — .vbs opens in WScript, .hta in mshta, .cpl and .inf through rundll32 — so this is the loudest source of matches and it arrives as a burst at image build time and after servicing.
Application installers and MSI self-healing claiming an extension with a launcher that shells through cmd.exe or rundll32.exe, which rewrite the command value on every repair cycle rather than only at first install.
Administrative baselines and Group Policy preferences that set associations fleet-wide, for instance forcing .ps1 and .vbs to open in an editor instead of executing, which writes a handler naming powershell.exe on every policy refresh.
Portable applications and installers running from an extracted temporary directory that register their associations while still in that directory, producing a handler path under the user's Temp folder.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.001, evaluated against their registry_set events.

Share this rule

/u/siemphony/d3cf5408-f80e-4e07-b143-b9480b1c033a

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

File association handler rewritten to a script host or LOLBin

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it