Accessibility Feature Binary Replaced for Backdoor

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects network traffic containing the string "sethc.exe" over TCP port 445 (SMB). This is indicative of an attacker attempting to exploit the 'Sticky Keys' accessibility feature for backdoor access, often by replacing the sethc.exe binary with a malicious executable. The detection specifically looks for this string in traffic flowing to the server on an established connection.