Change Default File Association To Executable Via Assoc

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•19

Detects when the `assoc` command-line utility is used to change the default file association of any extension to an executable (`exefile`). This technique can be used by adversaries for persistence or privilege escalation by making a specific file type execute a malicious program when opened.