Uncommon Assistive Technology Applications Execution Via AtBroker.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the execution of non-standard or uncommon assistive technology applications via "AtBroker.exe". AtBroker.exe is a legitimate Windows binary that can be abused to proxy the execution of other programs, often for defense evasion or persistence. This rule specifically looks for instances where AtBroker.exe is used to start applications that are not part of the common, built-in Windows assistive technologies.