attack.t1546.008

Potential Suspicious Activity Using SeCEdit

Apr 28, 2026 · attack.collection attack.discovery attack.persistence attack.credential-access attack.privilege-escalation attack.execution attack.stealth attack.defense-impairment attack.t1685.001 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1685 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·

Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Potential Privilege Escalation Using Symlink Between Osk and Cmd

Nov 26, 2025 · attack.privilege-escalation attack.persistence attack.t1546.008 ·

Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Persistence Via Sticky Key Backdoor

Oct 23, 2025 · attack.persistence attack.t1546.008 attack.privilege-escalation ·

Share on:

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

Sticky Key Like Backdoor Execution

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·

Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Sticky Key Like Backdoor Usage - Registry

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·

Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Suspicious Debugger Registration Cmdline

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.008 ·

Share on:

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).