Suspicious Debugger Registration Cmdline

calendar Mar 5, 2023 · attack.persistence attack.privilege_escalation attack.t1546.008  ·
Share on: linkedin copy

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

Sigma rule (View on GitHub)

 1title: Suspicious Debugger Registration Cmdline
 2id: ae215552-081e-44c7-805f-be16f975c8a2
 3status: test
 4description: Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).
 5references:
 6    - https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/
 7    - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
 8author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
 9date: 2019/09/06
10modified: 2022/08/06
11tags:
12    - attack.persistence
13    - attack.privilege_escalation
14    - attack.t1546.008
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection1:
20        CommandLine|contains: '\CurrentVersion\Image File Execution Options\'
21    selection2:
22        CommandLine|contains:
23            - 'sethc.exe'
24            - 'utilman.exe'
25            - 'osk.exe'
26            - 'magnify.exe'
27            - 'narrator.exe'
28            - 'displayswitch.exe'
29            - 'atbroker.exe'
30            - 'HelpPane.exe'
31    condition: all of selection*
32falsepositives:
33    - Unknown
34level: high

References

Related rules

to-top