Default File Association Modified via Remote Registry

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to modify default file associations via the remote registry, specifically looking for 'HKCR' (HKEY_CLASSES_ROOT) and 'shell\\open\\command' within TCP traffic on port 445 (SMB). This activity is often associated with persistence mechanisms where an attacker alters how certain file types are handled to execute malicious code.