File Association Hijacking is a technique that changes how the operating system opens a file type so a chosen program runs instead of the expected one. On Windows, it commonly targets shell or registry file associations, letting an attacker execute code when a user opens a familiar file extension.
How File Association Hijacking Works
File association hijacking changes the operating system’s normal file-opening behavior so a file type launches an attacker-chosen program instead of the expected one. Because users often trust familiar extensions, the abuse can blend into routine activity.
On Windows, this commonly involves shell-level or registry-based associations. The key security issue is not the file content itself, but the execution path that is triggered when the user double-clicks a file or opens it through the shell.
Why It Is Dangerous
File associations are a high-trust usability feature, which makes them a useful execution primitive for an attacker. If the association is altered successfully, a harmless-looking document, shortcut, or archive can become a launch point for arbitrary code execution without requiring the user to run an obviously suspicious executable.
This technique is especially effective when the altered association is tied to a file type that people open repeatedly in normal work. The attacker does not need to persuade the user to change habits, only to interact with a file type they already expect to be safe.
Where Exposure Comes From
Exposure usually depends on local execution rights, the ability to modify shell or registry settings, or another foothold that lets the attacker rewrite the association. In practice, this may follow initial compromise, malicious software installation, or abuse of a writable configuration area that influences file handling.
Organisations should treat association integrity as part of endpoint hardening and configuration control. Centralised build standards, restricted user write paths, and monitoring for suspicious registry or shell changes reduce the chance that a benign file type can be repointed to malicious code.
Detection and Recovery
Detection focuses on unexpected changes to file-open handlers, unusual parent-child process chains after a file is opened, and new executions that originate from a trusted extension or document workflow. Review should include the affected endpoint, the specific association change, and any follow-on process activity that indicates code execution.
After remediation, teams should verify whether the hijack was only a launch mechanism or whether it accompanied broader compromise. If the attacker gained execution through the altered association, investigate persistence, dropped payloads, scheduled tasks, startup entries, and any credentials, sessions, or tokens exposed during the intrusion.
Risk and Threat Considerations
File association hijacking is risky because it turns a normal user action into an execution event, which can mask malicious code behind everyday file handling. That makes it useful for initial execution, persistence, and social engineering alike.
Failure mechanism: The attacker modifies the association for a trusted file type, then waits for the user or a process to trigger the normal open action, causing the malicious program to run under an expected workflow.
Impact: The result can be arbitrary code execution, stealthier malware delivery, and a broader compromise chain that starts from a file a user believed was safe.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1546.001 — Event Triggered Execution: Change Default File Association | File association hijacking is this ATT&CK sub-technique. |
| Recommendation — Map suspicious file-association changes to T1546.001 and hunt for execution spawned by trusted file types. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | The technique abuses endpoint and shell configuration that should be locked down. |
| Recommendation — Harden file-association settings and monitor for unauthorized configuration changes. | ||
| NIST SP 800-53 Rev 5 | CM-6 — Configuration Settings | File associations are configuration settings that require controlled baselines and change oversight. |
| SI-3 — Malicious Code Protection | The technique is used to launch malicious code through normal user file handling. | |
| Recommendation — Enforce approved file-association baselines and alert on unauthorized deviations. Inspect file-triggered execution paths for malicious payloads before and after launch. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Secure design should avoid relying on user file-open behavior as a trusted execution path. |
| Recommendation — Design applications to avoid implicit trust in file-opening handlers and shell execution flows. | ||
Practitioner Guidance
Why practitioners should care: File associations are often treated as convenience settings, but they are also execution control points. Protect them with the same discipline used for other endpoint behavior that can launch code unexpectedly.
What to watch for: Investigate sudden association changes, unexpected handlers for common extensions, and process launches that do not match the user’s normal file-opening pattern. Those signals often matter more than the file name itself.
Practitioner takeaway: The real control is not only preventing malicious files, but preventing trusted file types from being redirected to malicious execution paths.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org