tfMITRE ATT&CK sub-technique

Accessibility Features T1546.008

sub-technique of T1546 Event Triggered Execution

Tactics: Persistence, Privilege Escalation
Platform: Windows
Version: 1.2
Created: 24 January 2020
Last modified: 24 October 2025
Contributor: Paul Speulstra, AECOM Global Security Operations Center

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules69th pct

Detection rules69th percentile · 69% of ATT&CK techniques have this many detection rules written or fewer.

Accessibility Features MITRE reference T1546.008

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Fox KittenG0117 ↗

Has used sticky keys to launch a command prompt.1

created 2020-12-211 referenceaka UNC757

APT41G0096 ↗

Leveraged sticky keys to establish persistence.1

created 2019-09-231 referenceaka Wicked Panda

APT3G0022 ↗

Replaces the Sticky Keys binary C:\Windows\System32\sethc.exe for persistence.1

created 2017-05-311 referenceaka Gothic Panda

APT29G0016 ↗

Used sticky-keys to obtain unauthenticated, privileged console access.1 2

created 2017-05-312 referencesaka IRON RITUAL

Deep PandaG0009 ↗

Has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.1

created 2017-05-311 referenceaka Shell Crew

AxiomG0001 ↗

Actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.1

created 2017-05-311 referenceaka Group 72

All 6 groups for this technique

Offense vs defense T1546.008

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 1

first rule: 2018 Q1

Accessibility Features detection strategy DET0033

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Accessibility Feature Hijacking via Binary Replacement or Registry Modification

Enterprise

1 platform

AN0094 · Windows

Defenders can observe suspicious replacement or tampering of system accessibility binaries (e.g., utilman.exe, sethc.exe, osk.exe) and anomalous modifications to registry keys used to redirect accessibility programs (such as IFEO keys). Additionally, execution of cmd.exe or other suspicious binaries triggered from the login screen by SYSTEM can be correlated as part of a behavior chain.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Time between registry modification and suspicious binary execution (e.g., < 1 hour) can be tuned.
TargetBinaryNames	Specific binaries monitored (e.g., utilman.exe, sethc.exe) can be adjusted per OS version and risk tolerance.
ParentProcess	Parent process of cmd.exe (e.g., winlogon.exe) may vary across legitimate and adversarial cases.
UserContext	Context of SYSTEM account execution vs. administrative sessions may influence tuning.
CommandLineContains	Tunable patterns such as launching cmd.exe, powershell, or LOLBins from accessibility binaries.

3 analytics

The Sysinternals tool Autoruns checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain Persistence. Running Autoruns periodically in an environment makes it possible to collect and monitor its output for differences, which may include the removal or addition of persistent tools. Depending on the persistence mechanism and location, legitimate software may be more likely to make changes than an adversary tool. Thus, this analytic may result in significant noise in a highly dynamic environment. While Autoruns is a convenient method to scan for programs using persistence mechanisms its scanning nature does not conform well to streaming based analytics. This analytic could be replaced with one that draws from sensors that collect registry and file information if streaming analytics are desired.

TypesSituational Awareness, TTPCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-SICA	System Init Config Analysis

An adversary can use accessibility features (Ease of Access), such as StickyKeys or Utilman, to launch a command shell from the logon screen and gain SYSTEM access. Since an adversary does not have physical access to the machine, this technique must be run within Remote Desktop. To prevent an adversary from getting to the login screen without first authenticating, Network-Level Authentication (NLA) must be enabled. If a debugger is set up for one of the accessibility features, then it will intercept the process launch of the feature and instead execute a new command line. This analytic looks for instances of cmd.exe or powershell.exe launched directly from the logon process, winlogon.exe. It should be used in tandem with CAR-2014-11-003, which detects the accessibility programs in the command line.

TypeTTPCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	parent_exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Look for instances of processes where the parent executable is winlogon.exe and the child is an instance of a command prompt.

processes = search Process:Create
winlogon_cmd = filter processes where (parent_exe == "winlogon.exe" and exe == "cmd.exe")
output winlogon_cmd

Splunk version of the above pseudocode.

index=__your_sysmon_index__ EventCode=1 ParentImage="C:\\Windows\\*\\winlogon.exe" Image="C:\\Windows\\*\\cmd.exe"

EQL version of the above pseudocode.

process where subtype.create and
  (process_name == "cmd.exe" and parent_process_name == "winlogon.exe")

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 parent_image="C:\Windows\System32\winlogon.exe" parent_image="C:\Windows\System32\cmd.exe"

The Windows Registry location HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options allows for parameters to be set for applications during execution. One feature used by malicious actors is the "Debugger" option. When a key has this value enabled, a Debugging command line can be specified. Windows will launch the Debugging command line, and pass the original command line in as an argument. Adversaries can set a Debugger for Accessibility Applications. The analytic looks for the original command line as an argument to the Debugger. When the strings "sethc.exe", "utilman.exe", "osk.exe", "narrator.exe", and "Magnify.exe" are detected in the arguments, but not as the main executable, it is very likely that a Debugger is set.

TypeTTPCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

One simple way to implement this technique is to note that in a default Windows configuration there are no spaces in the path to the system32 folder. If the accessibility programs are ever run with a Debugger set, then Windows will launch the Debugger process and append the command line to the accessibility program. As a result, a space is inserted in the command line before the path. Looking for any instances of a space in the command line before the name of an accessibility program will help identify when Debuggers are set.

process = search Process:Create
debuggers = filter process where (command_line match "$.* .*(sethc{{pipe}}utilman{{pipe}}osk{{pipe}}narrator{{pipe}}magnify)\.exe")
output debuggers

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 command IN ["$* *sethc.exe", "$* *utilman.exe", "$* *osk.exe", "$* *narrator.exe", "$* *magnify.exe"]

Unit tests

CAR’s own validation procedures for this analytic.

Although it does not actually utilize the Debugging command line, an easy way to test this analytic to run cmd.exe from a command window, supplying one of the strings as arguments.

["cmd.exe Magnify.exe"]

Tests10Executorscmd 9 · PowerShell 1Need elevation10 of 10Have prerequisites0Have cleanup10Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Attaches Command Prompt as a Debugger to a List of Target Processes

windows

PowerShell

Required

—

Yes

Attaches cmd.exe to a list of processes. Configure your own Input arguments to a different executable or list of executables. Upon successful execution, powershell will modify the registry and swap osk.exe with cmd.exe.

Input arguments

Name	Type	Default	Description
parent_list	string	osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe, atbroker.exe	Comma separated list of system binaries to which you want to attach each #{attached_process}. Default: "osk.exe"
attached_process	path	C:\windows\system32\cmd.exe	Full path to process to attach to target in #{parent_list}. Default: cmd.exe

Attack command

$input_table = "#{parent_list}".split(",")
$Name = "Debugger"
$Value = "#{attached_process}"
Foreach ($item in $input_table){
  $item = $item.trim()
  $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item"
  IF(!(Test-Path $registryPath))
  {
    New-Item -Path $registryPath -Force
    New-ItemProperty -Path $registryPath -Name $name -Value $Value -PropertyType STRING -Force
  }
  ELSE
  {
    New-ItemProperty -Path $registryPath -Name $name -Value $Value
  }
}

Cleanup command

$input_table = "#{parent_list}".split(",")
Foreach ($item in $input_table)
{
  $item = $item.trim()
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" /v Debugger /f 2>&1 | Out-Null
}

GUIDe9c62a8a-e91d-4250-90cf-c61ffcc124bb

Replace binary of sticky keys

windows

cmd

Required

—

Yes

Create Symbolic Link From osk.exe to cmd.exe

windows

cmd

Required

—

Yes

Atbroker.exe (AT) Executes Arbitrary Command via Registry Key

windows

cmd

Required

—

Yes

Auto-start application on user logon

windows

cmd

Required

—

Yes

Replace utilman.exe (Ease of Access Binary) with cmd.exe

windows

cmd

Required

—

Yes

Replace Magnify.exe (Magnifier binary) with cmd.exe

windows

cmd

Required

—

Yes

Replace Narrator.exe (Narrator binary) with cmd.exe

windows

cmd

Required

—

Yes

Replace DisplaySwitch.exe (Display Switcher binary) with cmd.exe

windows

cmd

Required

—

Yes

Replace AtBroker.exe (App Switcher binary) with cmd.exe

windows

cmd

Required

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Accessibility Features detections T1546.008

7 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

69th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs