Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
60 detections
Filters
Last updated
All Time
Detection languages
37
11
4
3
2
Contributors
14
12
7
6
4
Categories
31
8
8
7
5
Platforms
53
5
1
Products / Services
15
12
6
1
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
1
IDS Protocols
1
The following analytic detects modifications to Windows accessibility binaries such as sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, DisplaySwitch.exe, and AtBroker.exe. It leverages filesystem activity data from the Endpoint.Filesystem data model to identify changes to these specific files. This activity is significant because adversaries can exploit these binaries to gain unauthorized access or execute commands without logging in. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized system access and further compromise of the environment.
Detects a malicious sequence of actions originating from an Android Accessibility Service, specifically the 'SystemHelperService'. The activity involves the programmatic enablement of Developer Options and Wireless Debugging, followed by the unauthorized extraction of an ADB pairing PIN from the screen, bypassing user interaction requirements.
Detects anomalous configuration of Android devices by identifying instances where an accessibility service is granted combined with the enabling of wireless ADB debugging or ADB pairing code extraction. This behavior is often associated with malicious applications seeking unauthorized control or remote access to the device.
Detects the execution of known Windows accessibility binaries (e.g., sethc.exe, utilman.exe) where the internal metadata or original filename indicates that the process is actually cmd.exe. This is a common technique used by adversaries to gain unauthenticated command-line access with SYSTEM privileges via accessibility features, typically during the login screen process.
Generic rule content from file: IFEO Debugger Key Abuse on Accessibility Executables (Sticky-Keys Backdoor)
Detects modifications to the Image File Execution Options (IFEO) registry keys for critical Windows accessibility binaries such as osk.exe, utilman.exe, sethc.exe, magnify.exe, and narrator.exe. This technique is commonly used by adversaries to establish persistence or facilitate unauthenticated privilege escalation by replacing these tools with malicious executables (e.g., cmd.exe) that execute when triggered from the Windows login screen.
Detects TrymeLocker modifying the Image File Execution Options (IFEO) for accessibility binaries to establish a login screen backdoor with SYSTEM privileges.
Detects Android APK files that contain a combination of suspicious permissions and features often used for credential harvesting, specifically the binding of an accessibility service, SMS interception permissions, and overlay capability (System Alert Window).
Detects file creation or write access to C:\Windows\System32\sethc.exe or sethc.exe.bak, indicating a sticky keys backdoor technique where an attacker replaces the Sticky Keys binary with cmd.exe or another shell to obtain a SYSTEM-level shell at the login screen.
Detects registry modifications to the 'Debugger' value for Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique, known as IFEO (Image File Execution Options) hijacking, allows an adversary to redirect the execution of these binaries to a malicious payload. This is a common persistence mechanism used by malware, including TrymeLocker, to achieve unauthorized access or privilege escalation at the login screen.
Detects modifications or renames to critical Windows accessibility feature binaries (sethc.exe, utilman.exe, osk.exe, magnify.exe) located in System32. Adversaries frequently replace these binaries with malicious counterparts or command shells to achieve persistence and gain SYSTEM-level execution via accessibility shortcuts at the logon screen.
This rule detects potential privilege escalation or backdoor creation by monitoring for two primary indicators: 1) The modification of Windows Image File Execution Options (IFEO) registry keys for accessibility binaries (sethc.exe, osk.exe, utilman.exe, magnify.exe, narrator.exe, atbroker.exe) to point to unauthorized debuggers, and 2) The execution of common command interpreters or suspicious binaries spawned directly by these accessibility processes, which are commonly used in lock-screen bypass attacks.
Detects the modification of Image File Execution Options (IFEO) registry keys to assign a debugger to critical Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique is a common method for achieving persistence or privilege escalation by executing arbitrary code when these accessibility features are triggered, often at the Windows login screen.
Detects modifications or renames to critical Windows accessibility feature binaries (sethc.exe, utilman.exe, osk.exe, magnify.exe) located in System32. Adversaries frequently replace these binaries with malicious counterparts or command shells to achieve persistence and gain SYSTEM-level execution via accessibility shortcuts at the logon screen.
This rule detects attempts by the Rokarolla trojan to disable Google Play Protect on Android devices. It monitors for Accessibility Service actions, Android Accessibility Events, or App Control Actions that target 'com.google.android.gms' and contain keywords like 'play_protect', 'PlayProtect', 'finskyEula', 'security_scan', or 'disable'. This behavior indicates the malware is trying to suppress security scans by Google Play Protect.
Detects anomalous external network connections originating from specific Windows binaries (LockAppHost, makecab, Magnify) targeted by DeepLoad's APC injection technique. These native binaries rarely initiate external public network connections.
Detects TrymeLocker modifying the Image File Execution Options (IFEO) for accessibility binaries to establish a login screen backdoor with SYSTEM privileges.
Detects replacement of accessibility binaries for backdoor access
This rule detects network traffic containing the string "sethc.exe" over TCP port 445 (SMB). This is indicative of an attacker attempting to exploit the 'Sticky Keys' accessibility feature for backdoor access, often by replacing the sethc.exe binary with a malicious executable. The detection specifically looks for this string in traffic flowing to the server on an established connection.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
This rule detects various stages of DeepLoad malware activity, including initial delivery via PowerShell execution policy bypass with IEX/IRM style ClickFix, network retrieval using mshta.exe, persistence mechanisms like scheduled task creation and WMI, fileless injection through PowerShell Add-Type compilation and suspicious child processes (LockAppHost.exe, makecab.exe, Magnify.exe), credential stealing via filemanager.exe, and USB propagation indicators including specific C2 paths and LNK themed installer names. It also identifies known DeepLoad infrastructure domains.
Page 1 of 3