name: Overwriting Accessibility Binaries
id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae
version: 4
date: '2020-07-21'
author: David Dorsey, Splunk
status: production
type: TTP
description: Microsoft Windows contains accessibility features that can be launched
  with a key combination before a user has logged in. An adversary can modify or replace
  these programs so they can get a command prompt or backdoor without logging in to
  the system. This search looks for modifications to these binaries.
data_source:
- Sysmon Event ID 11
search:
  selection1:
    TargetFilename:
    - '*\\Windows\\System32\\sethc.exe*'
    - '*\\Windows\\System32\\utilman.exe*'
    - '*\\Windows\\System32\\osk.exe*'
    - '*\\Windows\\System32\\Magnify.exe*'
    - '*\\Windows\\System32\\Narrator.exe*'
    - '*\\Windows\\System32\\DisplaySwitch.exe*'
    - '*\\Windows\\System32\\AtBroker.exe*'
  condition: (selection1)
how_to_implement: You must be ingesting data that records the filesystem activity
  from your hosts to populate the Endpoint file-system data model node. If you are
  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
  you want to collect data.
known_false_positives: Microsoft may provide updates to these binaries. Verify that
  these changes do not correspond with your normal software update cycle.
references: []
tags:
  analytic_story:
  - Windows Privilege Escalation
  - Hermetic Wiper
  asset_type: Endpoint
  confidence: 90
  impact: 80
  message: A suspicious file modification or replace in $file_path$  in host $dest$
  mitre_attack_id:
  - T1546
  - T1546.008
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: file_path
    type: File
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 72
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.008/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog