Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
60 detections
Filters
Last updated
All Time
Detection languages
37
11
4
3
2
Contributors
14
12
7
6
4
Categories
31
8
8
7
5
Platforms
53
5
1
Products / Services
15
12
6
1
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
1
IDS Protocols
1
This rule detects the execution of common accessibility tools (osk.exe, powershell.exe, pwsh.exe, cmd.exe, reg.exe) with command-line arguments indicating an attempt to modify or leverage Windows accessibility features for persistence or privilege escalation. Specifically, it looks for command lines referencing 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility' and 'ATConfig\osk' or 'Accessibility\Session'. This behavior is often associated with adversaries attempting to maintain access or elevate privileges by manipulating accessibility programs like the On-Screen Keyboard.
Detects behavioral patterns
Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.
This rule detects attempts to establish persistence and elevate privileges by replacing the sticky keys executable (sethc.exe) with cmd.exe. This technique allows an attacker to gain a privileged command prompt on the Windows logon screen without authentication, typically by pressing the Shift key five times. The rule specifically looks for command-line arguments indicating the copying of cmd.exe to sethc.exe.
Detects the creation or modification of registry keys associated with Windows Assistive Technology applications, specifically focusing on changes to the 'ATs' and 'Configuration' keys under 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility'. This activity can be indicative of persistence or privilege escalation attempts by adversaries abusing accessibility features like 'atbroker.exe'. The rule includes filters to reduce false positives from legitimate 'atbroker.exe' activity or MSI installers.
By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system.
When the sticky keys are "activated" the privilleged shell is launched.
When the sticky keys are "activated" the privilleged shell is launched.
Detects scenarios where an attacker changed the IFEO settings related to sethc.
Detects scenarios where an attacker attempts to replace the original sethc.exe file by cmd.exe.
Detects scenarios where an attacker failed to replace the original sethc.exe file by cmd.exe.
Detects scenarios where an attacker attempts to replace the original sethc.exe file by cmd.exe.
Detects scenarios where an attacker attempts to enable the Image File Execution Options (IFEO) debugger for sethc.
Detects scenarios where an attacker calls the stickey key and execute CMD.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
'Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. [1]
Ref: https://attack.mitre.org/techniques/T1546/008/'
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. [1]
Ref: https://attack.mitre.org/techniques/T1546/008/'
Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
This query looks for persistence or priviledge escalation done using Windows Accessibility features.
It covers some of the techniques that could be used to utilize these features for malicious purposes,.
Including attaching a debugger using a registry config or overwriting these files.
Note: some developers might use such hacks for all sort of troubleshooting and testing purposes,.
But this better be prohibited, as it allows any account with access to the machine to run processes as SYSTEM.
Read more here: https://attack.mitre.org/wiki/Technique/T1015.
Tags: #AccessibilityFeatures, #StickyKeys, #ImageFileExecutionOptions, #Debugger, #PriviledgeEscalation, #Persistence.
It covers some of the techniques that could be used to utilize these features for malicious purposes,.
Including attaching a debugger using a registry config or overwriting these files.
Note: some developers might use such hacks for all sort of troubleshooting and testing purposes,.
But this better be prohibited, as it allows any account with access to the machine to run processes as SYSTEM.
Read more here: https://attack.mitre.org/wiki/Technique/T1015.
Tags: #AccessibilityFeatures, #StickyKeys, #ImageFileExecutionOptions, #Debugger, #PriviledgeEscalation, #Persistence.
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
Page 2 of 3