Técnica MITRE ATT&CK · Escalada de privilegios, Persistencia

`T1546.008` Accessibility Features

Subtécnica de T1546 Event Triggered Execution

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor…

Ficha en MITRE ATT&CK ↗

Reglas Sigma para cazarla

Persistence Via Sticky Key Backdoorcriticaltest · windows
Sticky Key Like Backdoor Executioncriticaltest · windows
Sticky Key Like Backdoor Usage - Registrycriticaltest · windows
Potential Privilege Escalation Using Symlink Between Osk and Cmdhightest · windows
Suspicious Debugger Registration Cmdlinehightest · windows
Potential Suspicious Activity Using SeCEditmediumtest · windows

Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.