Detection rules › Sigma
Atbroker Registry Change
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Known false positives
- Creation of non-default, legitimate at usage
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Privilege Escalation | |
| Stealth |
Telemetry coverage
Rule body
title: Atbroker Registry Change
id: 9577edbb-851f-4243-8c91-1d5b50c1a39b
status: test
description: Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
references:
- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
- https://lolbas-project.github.io/lolbas/Binaries/Atbroker/
author: Mateusz Wydra, oscd.community
date: 2020-10-13
modified: 2023-01-19
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1218
- attack.persistence
- attack.t1547
logsource:
category: registry_event
product: windows
detection:
selection:
TargetObject|contains:
- 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs'
- 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration'
filter_atbroker:
Image: 'C:\Windows\system32\atbroker.exe'
TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration'
Details: '(Empty)'
filter_uninstallers:
Image|startswith: 'C:\Windows\Installer\MSI'
TargetObject|contains: 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs'
condition: selection and not 1 of filter_*
falsepositives:
- Creation of non-default, legitimate at usage
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_*Stage 1: selection
selection:
TargetObject|contains:
- 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs'
- 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration'
Stage 2: not filter_*
filter_atbroker:
Image: 'C:\Windows\system32\atbroker.exe'
TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration'
Details: '(Empty)'
filter_uninstallers:
Image|startswith: 'C:\Windows\Installer\MSI'
TargetObject|contains: 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Details | eq | (Empty) | excludes:Details field:"Details" value:"(Empty)" |
Image | eq | C:\Windows\system32\atbroker.exe | excludes:Image field:"Image" value:"C:\Windows\system32\atbroker.exe" |
TargetObject | match | \Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration | excludes:TargetObject field:"TargetObject" value:"\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration" |
Image | starts_with | C:\Windows\Installer\MSI | excludes:Image field:"Image" value:"C:\Windows\Installer\MSI" |
TargetObject | match | Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs | excludes:TargetObject field:"TargetObject" value:"Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetObject | match |
| field:"TargetObject" kind:match |