Aggressive File Association Hijacking via Registry
Detects attempts to aggressively hijack file associations by modifying the Windows Registry using 'reg.exe' or 'cmd.exe'. Specifically looks for command-line arguments indicating deletion of 'UserChoice' registry keys (which define default applications for file types) and addition of 'ApplicationAssociationToasts' keys (which can suppress notifications related to file association changes). This behavior is indicative of an attacker trying to silently change default applications to maintain persistence or execute malicious code.
Microsoft Sentinel (KQL)
