Anomalous osk.exe Activity - Potential Accessibility Feature Abuse
Detects potential abuse of the Windows on-screen keyboard (osk.exe) by replacing it with cmd.exe or spawning unusual processes as SYSTEM. This technique can be used for persistence via accessibility features.
Sigma
