Detection rules › Splunk
ATBroker.exe Execution (Sysmon)
Helper binary for Assistive Technology (AT), Executes code defined in registry for a new AT. Modifications must be made to the system registry to either register or modify an existing Assistive Technology (AT) service entry
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '6076.18328'
title: ATBroker.exe Execution
description: Helper binary for Assistive Technology (AT), Executes code defined in
registry for a new AT. Modifications must be made to the system registry to either
register or modify an existing Assistive Technology (AT) service entry. Living Off
the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
"ATBroker.exe" TERM(/start) | table _time, host, user, signature_id, process, process_*,
parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id:
- T1218
data_category:
- Windows Sysmon
references:
- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
- https://oddvar.moe/2018/07/23/another-way-to-get-to-a-system-shell/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<") "ATBroker.exe" TERM(/start)
Stage 2: table
| table _time, host, user, signature_id, process, process_*, parent_process_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "EventCode=1" |
| 1 | "<EventID>1<" |
| 1 | "ATBroker.exe" |
| 1 | "/start" |