Sigma rule: Uncommon Assistive Technology Applications Execution Via AtBroker.EXE

Rule

Title

Uncommon Assistive Technology Applications Execution Via AtBroker.EXE

Status

test

Level

medium

Author

Mateusz Wydra, oscd.community

Date

2020-10-12

Modified

2024-03-06

File

rules/windows/process_creation/proc_creation_win_atbroker_uncommon_ats_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\AtBroker.exe'
    - OriginalFileName: 'AtBroker.exe'
selection_cli:
    CommandLine|contains: 'start'
filter_main_builtin:
    CommandLine|contains:
        - 'animations'
        - 'audiodescription'
        - 'caretbrowsing'
        - 'caretwidth'
        - 'colorfiltering'
        - 'cursorindicator'
        - 'cursorscheme'
        - 'filterkeys'
        - 'focusborderheight'
        - 'focusborderwidth'
        - 'highcontrast'
        - 'keyboardcues'
        - 'keyboardpref'
        - 'livecaptions'
        - 'magnifierpane'
        - 'messageduration'
        - 'minimumhitradius'
        - 'mousekeys'
        - 'Narrator'
        - 'osk'
        - 'overlappedcontent'
        - 'showsounds'
        - 'soundsentry'
        - 'speechreco'
        - 'stickykeys'
        - 'togglekeys'
        - 'voiceaccess'
        - 'windowarranging'
        - 'windowtracking'
        - 'windowtrackingtimeout'
        - 'windowtrackingzorder'
filter_optional_java:
    CommandLine|contains: 'Oracle_JavaAccessBridge'
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate, non-default assistive technology applications execution

Tags

• attack.stealth
• attack.t1218

MITRE ATT&CK ids this rule names

• T1218

References

• http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
• https://lolbas-project.github.io/lolbas/Binaries/Atbroker/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_atbroker_uncommon_ats_execution.yml