Sticky Keys Backdoor via sethc.exe Replacement in System32

Danny Y@zendannyy

•updated Jun 29, 2026•0•0•7

Detects file creation or write access to C:\Windows\System32\sethc.exe or sethc.exe.bak, indicating a sticky keys backdoor technique where an attacker replaces the Sticky Keys binary with cmd.exe or another shell to obtain a SYSTEM-level shell at the login screen.