Detection rules › Sigma
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE
Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".
Known false positives
- Legitimate, non-default assistive technology applications execution
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
title: Uncommon Assistive Technology Applications Execution Via AtBroker.EXE
id: f24bcaea-0cd1-11eb-adc1-0242ac120002
status: test
description: Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".
references:
- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
- https://lolbas-project.github.io/lolbas/Binaries/Atbroker/
author: Mateusz Wydra, oscd.community
date: 2020-10-12
modified: 2024-03-06
tags:
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\AtBroker.exe'
- OriginalFileName: 'AtBroker.exe'
selection_cli:
CommandLine|contains: 'start'
filter_main_builtin:
CommandLine|contains:
- 'animations'
- 'audiodescription'
- 'caretbrowsing'
- 'caretwidth'
- 'colorfiltering'
- 'cursorindicator'
- 'cursorscheme'
- 'filterkeys'
- 'focusborderheight'
- 'focusborderwidth'
- 'highcontrast'
- 'keyboardcues'
- 'keyboardpref'
- 'livecaptions'
- 'magnifierpane'
- 'messageduration'
- 'minimumhitradius'
- 'mousekeys'
- 'Narrator'
- 'osk'
- 'overlappedcontent'
- 'showsounds'
- 'soundsentry'
- 'speechreco'
- 'stickykeys'
- 'togglekeys'
- 'voiceaccess'
- 'windowarranging'
- 'windowtracking'
- 'windowtrackingtimeout'
- 'windowtrackingzorder'
filter_optional_java:
CommandLine|contains: 'Oracle_JavaAccessBridge'
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate, non-default assistive technology applications execution
level: medium
Stages and Predicates
Stage 0: condition
all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*Stage 1: selection_img
selection_img:
- Image|endswith: '\AtBroker.exe'
- OriginalFileName: 'AtBroker.exe'
Stage 2: selection_cli
selection_cli:
CommandLine|contains: 'start'
Stage 3: not filter_main_builtin
filter_main_builtin:
CommandLine|contains:
- 'animations'
- 'audiodescription'
- 'caretbrowsing'
- 'caretwidth'
- 'colorfiltering'
- 'cursorindicator'
- 'cursorscheme'
- 'filterkeys'
- 'focusborderheight'
- 'focusborderwidth'
- 'highcontrast'
- 'keyboardcues'
- 'keyboardpref'
- 'livecaptions'
- 'magnifierpane'
- 'messageduration'
- 'minimumhitradius'
- 'mousekeys'
- 'Narrator'
- 'osk'
- 'overlappedcontent'
- 'showsounds'
- 'soundsentry'
- 'speechreco'
- 'stickykeys'
- 'togglekeys'
- 'voiceaccess'
- 'windowarranging'
- 'windowtracking'
- 'windowtrackingtimeout'
- 'windowtrackingzorder'
Stage 4: not filter_optional_java
filter_optional_java:
CommandLine|contains: 'Oracle_JavaAccessBridge'
Exclusions
The rule actively suppresses these predicates.
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match value:"start" |
Image | ends_with |
| field:"Image" kind:ends_with value:"\AtBroker.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"AtBroker.exe" |