T1546.008 Accessibility Features
Sub-technique of T1546 Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Persistence Via Sticky Key Backdoorcriticaltest · windows
- Sticky Key Like Backdoor Executioncriticaltest · windows
- Sticky Key Like Backdoor Usage - Registrycriticaltest · windows
- Potential Privilege Escalation Using Symlink Between Osk and Cmdhightest · windows
- Suspicious Debugger Registration Cmdlinehightest · windows
- Potential Suspicious Activity Using SeCEditmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.