Sigma rule: Persistence Via Sticky Key Backdoor

Rule

Title

Persistence Via Sticky Key Backdoor

Status

test

Level

critical

Author

Sreeman

Date

2020-02-18

Modified

2023-03-07

File

rules/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system.
When the sticky keys are "activated" the privilleged shell is launched.

Log source

product

windows

category

process_creation

Detection

selection:
    CommandLine|contains|all:
        - 'copy '
        - '/y '
        - 'C:\windows\system32\cmd.exe C:\windows\system32\sethc.exe'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.persistence
• attack.t1546.008
• attack.privilege-escalation

MITRE ATT&CK ids this rule names

• T1546.008

References

• https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html
• https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf
• https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml