{"id":"2fdefcb3-dbda-401e-ae23-f0db027628bc","title":"Sticky Key Like Backdoor Execution","description":"Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen","author":"Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community","status":"test","level":"critical","date":"2018-03-15","modified":"2023-03-07","tags":["attack.privilege-escalation","attack.persistence","attack.t1546.008","car.2014-11-003","car.2014-11-008"],"technique_ids":["T1546.008"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors"],"source_path":"rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml","source_sha256":"c93d12212bd750be2c2e932e0a75cbdc503ee98cb4a926ac0652eb0c976e3d8d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Sticky Key Like Backdoor Execution\nid: 2fdefcb3-dbda-401e-ae23-f0db027628bc\nrelated:\n    - id: baca5663-583c-45f9-b5dc-ea96a22ce542\n      type: derived\nstatus: test\ndescription: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen\nreferences:\n    - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors\nauthor: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community\ndate: 2018-03-15\nmodified: 2023-03-07\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1546.008\n    - car.2014-11-003\n    - car.2014-11-008\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\winlogon.exe'\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\cscript.exe'\n            - '\\mshta.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\regsvr32.exe'\n            - '\\rundll32.exe'\n            - '\\wscript.exe'\n            - '\\wt.exe'\n        CommandLine|contains:\n            - 'sethc.exe'\n            - 'utilman.exe'\n            - 'osk.exe'\n            - 'Magnify.exe'\n            - 'Narrator.exe'\n            - 'DisplaySwitch.exe'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: critical\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.008","id":"T1546.008","name":"Accessibility Features","page":"techniques/enterprise/T1546.008/"}],"data_path":"data/detection-rules/2fdefcb3-dbda-401e-ae23-f0db027628bc.json","kind":"sigma"}