Detection rules › Splunk
Suspicious Execution of Accessibility Tool Debuggers (Sysmon)
Threat actors may establish persistence or elevate privileges by executing malicious content through accessibility features. Windows accessibility features can be launched with a key combination before user login, such as from the Windows logon screen. Threat actors can modify the launch process of these programs to gain a command prompt or backdoor access without logging into the system. This use case detects the execution of accessibility tools by a debugger process, which can indicate an attempt to gain unauthorized access or persistence through malicious use of these tools.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546.008 Event Triggered Execution: Accessibility Features |
| Privilege Escalation | T1546.008 Event Triggered Execution: Accessibility Features |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '31925.57027'
title: Suspicious Execution of Accessibility Tool Debuggers
description: Threat actors may establish persistence or elevate privileges by executing
malicious content through accessibility features. Windows accessibility features
can be launched with a key combination before user login, such as from the Windows
logon screen. Threat actors can modify the launch process of these programs to gain
a command prompt or backdoor access without logging into the system. This use case
detects the execution of accessibility tools by a debugger process, which can indicate
an attempt to gain unauthorized access or persistence through malicious use of these
tools.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
"winlogon.exe" ("cmd.exe" OR "cscript.exe" OR "mshta.exe" OR "powershell.exe" OR
"pwsh.exe" OR "regsvr32.exe" OR "rundll32.exe" OR "wscript.exe" OR "wt.exe") ("sethc.exe"
OR "utilman.exe" OR "osk.exe" OR "Magnify.exe" OR "Narrator.exe" OR "DisplaySwitch.exe"
OR "atbroker.exe" OR "HelpPane.exe") | regex parent_process_name="(?i)winlogon\.exe"|
regex process_name="(?i)(cmd|cscript|mshta|powershell|pwsh|regsvr32|rundll32|wscript|wt)\.exe"|
regex process="(?i)(sethc|utilman|osk|Magnify|Narrator|DisplaySwitch|atbroker|HelpPane)\.exe"
| table _time, host, user, parent_process_name, process, process_name | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- persistence:event triggered execution:accessibility features
technique_id:
- T1546.008
data_category:
- Windows Sysmon
references:
- https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "winlogon.exe" ("cmd.exe" OR "cscript.exe" OR "mshta.exe" OR "powershell.exe" OR "pwsh.exe" OR "regsvr32.exe" OR "rundll32.exe" OR "wscript.exe" OR "wt.exe") ("sethc.exe" OR "utilman.exe" OR "osk.exe" OR "Magnify.exe" OR "Narrator.exe" OR "DisplaySwitch.exe" OR "atbroker.exe" OR "HelpPane.exe")
Stage 2: regex
| regex parent_process_name="(?i)winlogon\.exe"
Stage 3: regex
| regex process_name="(?i)(cmd|cscript|mshta|powershell|pwsh|regsvr32|rundll32|wscript|wt)\.exe"
Stage 4: regex
| regex process="(?i)(sethc|utilman|osk|Magnify|Narrator|DisplaySwitch|atbroker|HelpPane)\.exe"
Stage 5: table
| table _time, host, user, parent_process_name, process, process_name
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
parent_process_name | regex_match |
|
process | regex_match |
|
process_name | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "winlogon.exe" |
| 1 | "cmd.exe" |
| 1 | "cscript.exe" |
| 1 | "mshta.exe" |
| 1 | "powershell.exe" |
| 1 | "pwsh.exe" |
| 1 | "regsvr32.exe" |
| 1 | "rundll32.exe" |
| 1 | "wscript.exe" |
| 1 | "wt.exe" |
| 1 | "sethc.exe" |
| 1 | "utilman.exe" |
| 1 | "osk.exe" |
| 1 | "Magnify.exe" |
| 1 | "Narrator.exe" |
| 1 | "DisplaySwitch.exe" |
| 1 | "atbroker.exe" |
| 1 | "HelpPane.exe" |