High Volume Registry Modifications to File Associations for Execution Prevention
Detects a high volume of modifications to the default 'open' command for various file extensions in the registry. This technique is used by malware to prevent users from running applications or opening documents, effectively causing a denial of service.
Microsoft Sentinel (KQL)
