Detection rules › Sigma

Atbroker Registry Change

Severity
medium
Author
Mateusz Wydra, oscd.community
Source
upstream

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1547 Boot or Logon Autostart Execution
Privilege EscalationT1547 Boot or Logon Autostart Execution
Defense EvasionT1218 System Binary Proxy Execution

Event coverage

ProviderEvent IDTitle
Sysmon12RegistryEvent (Object create and delete)
Sysmon13RegistryEvent (Value Set)
Sysmon14RegistryEvent (Key and Value Rename)

Stages and Predicates

Stage 1: selection

or:
TargetObject|contains: 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs'
TargetObject|contains: 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration'

Stage 2: not 1 of filter_*

or:
Details: '(Empty)'
Image: 'C:\Windows\system32\atbroker.exe'
TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration'
Image|startswith: 'C:\Windows\Installer\MSI'
TargetObject|contains: 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailseq
  • (Empty) corpus 24 (sigma 24)
Imageeq
  • C:\Windows\system32\atbroker.exe
Imagestarts_with
  • C:\Windows\Installer\MSI corpus 3 (sigma 3)
TargetObjectmatch
  • Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs
  • Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration
  • \Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration