Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Technique Change Default File Association
Каталоги
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
RU
Риски
Каталоги
MITRE ATT&CK
Техника
Change Default File Associatio...
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Event Triggered Execution:  Change Default File Association

ID Name
.001 Change Default File Association
.002 Screensaver
.003 Windows Management Instrumentation Event Subscription
.004 Unix Shell Configuration Modification
.005 Trap
.006 LC_LOAD_DYLIB Addition
.007 Netsh Helper DLL
.008 Accessibility Features
.009 AppCert DLLs
.010 AppInit DLLs
.011 Application Shimming
.012 Image File Execution Options Injection
.013 PowerShell Profile
.014 Emond
.015 Component Object Model Hijacking
.016 Installer Packages

Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility.(Citation: Microsoft Change Default Programs)(Citation: Microsoft File Handlers)(Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened. System file associations are listed under HKEY_CLASSES_ROOT\.[extension], for example HKEY_CLASSES_ROOT\.txt. The entries point to a handler for that extension located at HKEY_CLASSES_ROOT\\[handler]. The various commands are then listed as subkeys underneath the shell key at HKEY_CLASSES_ROOT\\[handler]\shell\\[action]\command. For example: * HKEY_CLASSES_ROOT\txtfile\shell\open\command * HKEY_CLASSES_ROOT\txtfile\shell\print\command * HKEY_CLASSES_ROOT\txtfile\shell\printto\command The values of the keys listed are commands that are executed when the handler opens the file extension. Adversaries can modify these values to continually execute arbitrary commands.(Citation: TrendMicro TROJ-FAKEAV OCT 2012)

ID: T1546.001
Sub-technique of:  T1546
Tactic(s): Persistence, Privilege Escalation
Platforms: Windows
Permissions Required: Administrator, SYSTEM, User
Data Sources: Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Modification
Version: 1.0
Created: 24 Jan 2020
Last Modified: 20 Apr 2022

Procedure Examples
Name Description
SILENTTRINITY

SILENTTRINITY can conduct an image hijack of an `.msc` file extension as part of its UAC bypass process.(Citation: GitHub SILENTTRINITY Modules July 2019)
Kimsuky

Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.(Citation: Securelist Kimsuky Sept 2013)

Mitigations
Mitigation Description
Change Default File Association Mitigation

Direct mitigation of this technique is not recommended since it is a legitimate function that can be performed by users for software preferences. Follow Microsoft's best practices for file associations. (Citation: MSDN File Associations) Identify and block potentially malicious software that may be executed by this technique using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Detection

Collect and analyze changes to Registry keys that associate file extensions to default applications for execution and correlate with unknown process launch activity or unusual file types for that process. User file association preferences are stored under [HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts and override associations configured under [HKEY_CLASSES_ROOT]. Changes to a user's preference will occur under this entry's subkeys. Also look for abnormal process call trees for execution of other commands that could relate to Discovery actions or other techniques.

References

  1. Sioting, S. (2012, October 8). TROJ_FAKEAV.GZD. Retrieved August 8, 2018.
  2. Plett, C. et al.. (2017, October 15). assoc. Retrieved August 7, 2018.
  3. Microsoft. (n.d.). Specifying File Handlers for File Name Extensions. Retrieved November 13, 2014.
  4. Microsoft. (n.d.). Change which programs Windows 7 uses by default. Retrieved July 26, 2016.
  5. Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.
  6. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
Навигация

Каталоги

БДУ ФСТЭК:
УБИ.015 Угроза доступа к защищаемым файлам с использованием обходного пути
Угроза заключается в возможности получения нарушителем доступа к скрытым/защищаемым каталогам или файлам посредством различных в...

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.