CAPECattack pattern
CAPEC-556 Replace File Extension Handlers
- Abstraction
- Detailed
- Status
- Draft
- CAPEC version
- 3.9
Description
When a file is opened, its file handler is checked to determine which program opens the file. File handlers are configuration properties of many operating systems. Applications can modify the file handler for a given file extension to call an arbitrary program when a file with the given extension is opened.
Mitigations
• Inspect registry for changes. Limit privileges of user accounts so changes to default file handlers can only be performed by authorized administrators.
Related
Att&ck technique · MITRE ATT&CK (1)
- T1546.001 Change Default File Association sub-technique
Child of · CAPEC (1)
- CAPEC-542 Targeted Malware attack pattern
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
Referenced by CWE · attack pattern (1)
- CWE-284 Improper Access Control weakness