Detection rules › Splunk

Overwriting Accessibility Binaries

Author
David Dorsey, Splunk
Source
upstream

The following analytic detects modifications to Windows accessibility binaries such as sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, DisplaySwitch.exe, and AtBroker.exe. It leverages filesystem activity data from the Endpoint.Filesystem data model to identify changes to these specific files. This activity is significant because adversaries can exploit these binaries to gain unauthorized access or execute commands without logging in. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized system access and further compromise of the environment.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546.008 Event Triggered Execution: Accessibility Features
Privilege EscalationT1546.008 Event Triggered Execution: Accessibility Features

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: tstats

tstats WHERE (Filesystem.file_path="*\\\\Windows\\\\System32\\\\AtBroker.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\DisplaySwitch.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\Magnify.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\Narrator.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\osk.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\sethc.exe*" OR Filesystem.file_path="*\\\\Windows\\\\System32\\\\utilman.exe*") BY Filesystem.action, Filesystem.dest, Filesystem.file_access_time, Filesystem.file_create_time, Filesystem.file_hash, Filesystem.file_modify_time, Filesystem.file_name, Filesystem.file_path, Filesystem.file_acl, Filesystem.file_size, Filesystem.process_guid, Filesystem.process_id, Filesystem.user, Filesystem.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Filesystem.file_patheq
  • *\\Windows\\System32\\AtBroker.exe*
  • *\\Windows\\System32\\DisplaySwitch.exe*
  • *\\Windows\\System32\\Magnify.exe*
  • *\\Windows\\System32\\Narrator.exe*
  • *\\Windows\\System32\\osk.exe*
  • *\\Windows\\System32\\sethc.exe*
  • *\\Windows\\System32\\utilman.exe*