COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-556

Replace File Extension Handlers

When a file is opened, its file handler is checked to determine which program opens the file. File handlers are configuration properties of many operating systems. Applications can modify the file handler for a given file extension to call an arbitrary program when a file with the given extension is opened.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

When a file is opened, its file handler is checked to determine which program opens the file. File handlers are configuration properties of many operating systems. Applications can modify the file handler for a given file extension to call an arbitrary program when a file with the given extension is opened.

Requirements

What does the attack require?

Prerequisites

  • Target application or infrastructure exposes an exploitable vulnerability surface.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Defence

How is it prevented and mitigated?

1
Inspect registry for changes. Limit privileges of user accounts so changes to default file handlers can only be performed by authorized administrators.
CAPEC-556: Replace File Extension Handlers — DayBreach Saldırı Sözlüğü · DayBreach