Persistence Via Sticky Key Backdoor
This rule detects attempts to establish persistence and elevate privileges by replacing the sticky keys executable (sethc.exe) with cmd.exe. This technique allows an attacker to gain a privileged command prompt on the Windows logon screen without authentication, typically by pressing the Shift key five times. The rule specifically looks for command-line arguments indicating the copying of cmd.exe to sethc.exe.
Sigma
