Detection rules › Splunk
Suspicious Execution of Accessibility Tool Debuggers (Windows Event Log)
Threat actors may establish persistence or elevate privileges by executing malicious content through accessibility features. Windows accessibility features can be launched with a key combination before user login, such as from the Windows logon screen. Threat actors can modify the launch process of these programs to gain a command prompt or backdoor access without logging into the system. This use case detects the execution of accessibility tools by a debugger process, which can indicate an attempt to gain unauthorized access or persistence through malicious use of these tools.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546.008 Event Triggered Execution: Accessibility Features |
| Privilege Escalation | T1546.008 Event Triggered Execution: Accessibility Features |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '31925.57055'
title: Suspicious Execution of Accessibility Tool Debuggers
description: Threat actors may establish persistence or elevate privileges by executing
malicious content through accessibility features. Windows accessibility features
can be launched with a key combination before user login, such as from the Windows
logon screen. Threat actors can modify the launch process of these programs to gain
a command prompt or backdoor access without logging into the system. This use case
detects the execution of accessibility tools by a debugger process, which can indicate
an attempt to gain unauthorized access or persistence through malicious use of these
tools.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) ("cmd.exe" OR "cscript.exe" OR "mshta.exe" OR
"powershell.exe" OR "pwsh.exe" OR "regsvr32.exe" OR "rundll32.exe" OR "wscript.exe"
OR "wt.exe") ("sethc.exe" OR "utilman.exe" OR "osk.exe" OR "Magnify.exe" OR "Narrator.exe"
OR "DisplaySwitch.exe" OR "atbroker.exe" OR "HelpPane.exe") | where isnull(parent_process_name)|
regex process_name="(?i)(cmd|cscript|mshta|powershell|pwsh|regsvr32|rundll32|wscript|wt)\.exe"|
regex process="(?i)(sethc|utilman|osk|Magnify|Narrator|DisplaySwitch|atbroker|HelpPane)\.exe"
| table _time, host, user, parent_process_name, process, process_name | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- persistence:event triggered execution:accessibility features
technique_id:
- T1546.008
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) ("cmd.exe" OR "cscript.exe" OR "mshta.exe" OR "powershell.exe" OR "pwsh.exe" OR "regsvr32.exe" OR "rundll32.exe" OR "wscript.exe" OR "wt.exe") ("sethc.exe" OR "utilman.exe" OR "osk.exe" OR "Magnify.exe" OR "Narrator.exe" OR "DisplaySwitch.exe" OR "atbroker.exe" OR "HelpPane.exe")
Stage 2: where
| where isnull(parent_process_name)
Stage 3: regex
| regex process_name="(?i)(cmd|cscript|mshta|powershell|pwsh|regsvr32|rundll32|wscript|wt)\.exe"
Stage 4: regex
| regex process="(?i)(sethc|utilman|osk|Magnify|Narrator|DisplaySwitch|atbroker|HelpPane)\.exe"
Stage 5: table
| table _time, host, user, parent_process_name, process, process_name
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
parent_process_name | is_null | |
process | regex_match |
|
process_name | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "cmd.exe" |
| 1 | "cscript.exe" |
| 1 | "mshta.exe" |
| 1 | "powershell.exe" |
| 1 | "pwsh.exe" |
| 1 | "regsvr32.exe" |
| 1 | "rundll32.exe" |
| 1 | "wscript.exe" |
| 1 | "wt.exe" |
| 1 | "sethc.exe" |
| 1 | "utilman.exe" |
| 1 | "osk.exe" |
| 1 | "Magnify.exe" |
| 1 | "Narrator.exe" |
| 1 | "DisplaySwitch.exe" |
| 1 | "atbroker.exe" |
| 1 | "HelpPane.exe" |