Custom File Open Handler Executes PowerShell
Detects the abuse of custom file open handlers by modifying registry keys to execute PowerShell commands. This technique can be used for persistence or defense evasion by adversaries to run arbitrary code when a specific file type is opened.
Sigma
