New File Association Using Exefile for Defense Evasion
Detects the abuse of the 'exefile' handler in new file associations within the Windows Registry. This technique can be used by adversaries to bypass security products by associating a malicious executable with a common file extension, causing the malicious executable to run when a user interacts with that file type.
Sigma
