Windows Accessibility Feature Registry Modification via Atbroker
Detects the creation or modification of registry keys associated with Windows Assistive Technology applications, specifically focusing on changes to the 'ATs' and 'Configuration' keys under 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility'. This activity can be indicative of persistence or privilege escalation attempts by adversaries abusing accessibility features like 'atbroker.exe'. The rule includes filters to reduce false positives from legitimate 'atbroker.exe' activity or MSI installers.
Sigma
