CAPEC-556: Replace File Extension Handlers
Detailed
Draft
CAPEC版本: 3.9
更新日期: 2023-01-24
攻击模式描述
When a file is opened, its file handler is checked to determine which program opens the file. File handlers are configuration properties of many operating systems. Applications can modify the file handler for a given file extension to call an arbitrary program when a file with the given extension is opened.
缓解措施
Inspect registry for changes. Limit privileges of user accounts so changes to default file handlers can only be performed by authorized administrators.
分类映射
| 分类名称 | 条目ID | 条目名称 |
|---|---|---|
| ATTACK | 1546.001 | Event Triggered Execution:Change Default File Association |