Detection rules › Splunk
ATBroker.exe Execution (Windows Event Log)
Helper binary for Assistive Technology (AT), Executes code defined in registry for a new AT. Modifications must be made to the system registry to either register or modify an existing Assistive Technology (AT) service entry
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
id: '6076.6521'
title: ATBroker.exe Execution
description: Helper binary for Assistive Technology (AT), Executes code defined in
registry for a new AT. Modifications must be made to the system registry to either
register or modify an existing Assistive Technology (AT) service entry. Living Off
the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ("EventCode=4688" OR "<EventID>4688<")
"ATBroker.exe" TERM(/start) | table _time, host, user, signature_id, process, process_*,
parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id:
- T1218
data_category:
- Windows event logs
- Process command-line parameters
references:
- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
- https://oddvar.moe/2018/07/23/another-way-to-get-to-a-system-shell/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ("EventCode=4688" OR "<EventID>4688<") "ATBroker.exe" TERM(/start)
Stage 2: table
| table _time, host, user, signature_id, process, process_*, parent_process_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "EventCode=4688" |
| 1 | "<EventID>4688<" |
| 1 | "ATBroker.exe" |
| 1 | "/start" |