Home/ MITRE Matrix/ Privilege Escalation/ T1546.001

T1546.001Change Default File Association

T1546.001 — Change Default File Association is a MITRE ATT&CK technique in the Privilege Escalation tactic. Clankerusecase tracks 5 detection use cases covering it.

Privilege EscalationPersistence

View on the matrix → Filter Detection Library MITRE official spec ↗

5Use cases

0Articles

0Sub-techniques

2Tactics

↑ Parent technique: T1546 · Event Triggered Execution

Use cases covering this technique (5)

Windows Change File Association Command To Notepad ESCU actions · alerting P Windows New Default File Association Value Set ESCU actions · hunting P Change Default File Association ESCU actions · alerting P Suspicious Changes to File Associations ESCU actions · alerting P Windows Change Default File Association For No File Ext ESCU actions · alerting P