Detection rules › Splunk
Overwriting Accessibility Binaries
The following analytic detects modifications to Windows accessibility binaries such as sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, DisplaySwitch.exe, and AtBroker.exe. It leverages filesystem activity data from the Endpoint.Filesystem data model to identify changes to these specific files. This activity is significant because adversaries can exploit these binaries to gain unauthorized access or execute commands without logging in. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized system access and further compromise of the environment.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546.008 Event Triggered Execution: Accessibility Features |
| Privilege Escalation | T1546.008 Event Triggered Execution: Accessibility Features |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 11 | FileCreate |
Stages and Predicates
Stage 1: tstats
tstats WHERE (Filesystem.file_path="*\\\\Windows\\\\System32\\\\AtBroker.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\DisplaySwitch.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\Magnify.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\Narrator.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\osk.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\sethc.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\utilman.exe*") BY Filesystem.action, Filesystem.dest, Filesystem.file_access_time, Filesystem.file_create_time, Filesystem.file_hash, Filesystem.file_modify_time, Filesystem.file_name, Filesystem.file_path, Filesystem.file_acl, Filesystem.file_size, Filesystem.process_guid, Filesystem.process_id, Filesystem.user, Filesystem.vendor_product
Stage 2: search
search
Stage 3: search
search
Stage 4: search
search
Stage 5: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Filesystem.file_path | eq |
|