DetailedCAPEC-556
CAPEC-556: Replace File Extension Handlers
Description
When a file is opened, its file handler is checked to determine which program opens the file. File handlers are configuration properties of many operating systems. Applications can modify the file handler for a given file extension to call an arbitrary program when a file with the given extension is opened.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Inject Unexpected Items
Mitigations
- Inspect registry for changes. Limit privileges of user accounts so changes to default file handlers can only be performed by authorized administrators.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-USICAUser Session Init Config Analysis1 shared
- D3-ANAAAdministrative Network Activity Analysis1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared
- D3-PTProcess Termination1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2014-11-003Debuggers for Accessibility Applications1 shared
- CAR-2014-11-008Command Launched from WinLogon1 shared
- CAR-2020-09-002Component Object Model Hijacking1 shared
- CAR-2020-09-005AppInit DLLs1 shared
- CAR-2020-11-011Registry Edit from Screensaver1 shared
- CAR-2013-01-002Autorun Differences1 shared