legitimate users or administrators may run the ftype command to check or modify file associations. filter alerts if used within authorized maintenance activities.

Techniques

T1059.003

Sample rules

Windows File Association Modification via Ftype

source: splunk
technicques:
- T1059.003

Description

This analytic detects the use of the ftype command to modify Windows file associations. Attackers can abuse this functionality to change how specific file types are handled, potentially redirecting legitimate file execution to malicious payloads. If confirmed malicious, this behavior may enable persistence, execution of unauthorized code, or evasion of security controls.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Endpoint.Processes where

Processes.process="*ftype*=*"

by Processes.process Processes.vendor_product Processes.user_id
   Processes.process_hash Processes.parent_process_name
   Processes.parent_process_exec Processes.action Processes.dest
   Processes.process_current_directory Processes.process_path
   Processes.process_integrity_level Processes.original_file_name
   Processes.parent_process Processes.parent_process_path
   Processes.parent_process_guid Processes.parent_process_id
   Processes.process_guid Processes.process_id
   Processes.user Processes.process_name


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_file_association_modification_via_ftype_filter`