Title:
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE
Status:
test
Description:Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".
References:
-http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
-https://lolbas-project.github.io/lolbas/Binaries/Atbroker/
Author: Mateusz Wydra, oscd.community
Date: 2020-10-12
modified:2024-03-06
Tags:
- -'attack.stealth'
- -'attack.t1218'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_img:
Image|endswith:
'\AtBroker.exe'
OriginalFileName:
'AtBroker.exe'
selection_cli:
CommandLine|contains:
'start'
filter_main_builtin:
CommandLine|contains:
-'animations'
-'audiodescription'
-'caretbrowsing'
-'caretwidth'
-'colorfiltering'
-'cursorindicator'
-'cursorscheme'
-'filterkeys'
-'focusborderheight'
-'focusborderwidth'
-'highcontrast'
-'keyboardcues'
-'keyboardpref'
-'livecaptions'
-'magnifierpane'
-'messageduration'
-'minimumhitradius'
-'mousekeys'
-'Narrator'
-'osk'
-'overlappedcontent'
-'showsounds'
-'soundsentry'
-'speechreco'
-'stickykeys'
-'togglekeys'
-'voiceaccess'
-'windowarranging'
-'windowtracking'
-'windowtrackingtimeout'
-'windowtrackingzorder'
filter_optional_java:
CommandLine|contains:
'Oracle_JavaAccessBridge'
condition:
all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
-Legitimate, non-default assistive technology applications execution
Level:
medium
