Sigma rule: Potential Attachment Manager Settings Associations Tamper

Rule

Title

Potential Attachment Manager Settings Associations Tamper

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-08-01

Modified

2023-08-17

File

rules/windows/registry/registry_set/registry_set_policies_associations_tamper.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)

Log source

product

windows

category

registry_set

Detection

selection_main:
    TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\'
selection_value_default_file_type_rsik:
    TargetObject|endswith: '\DefaultFileTypeRisk'
    Details: 'DWORD (0x00006152)'
selection_value_low_risk_filetypes:
    TargetObject|endswith: '\LowRiskFileTypes'
    Details|contains: # Add more as you see fit
        - '.zip;'
        - '.rar;'
        - '.exe;'
        - '.bat;'
        - '.com;'
        - '.cmd;'
        - '.reg;'
        - '.msi;'
        - '.htm;'
        - '.html;'
condition: selection_main and 1 of selection_value_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.defense-impairment

References

• https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
• https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_policies_associations_tamper.yml