Sticky Key Like Backdoor Execution

Hunt Hypothesis

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Detection Rule

Sigma (Original)

title: Sticky Key Like Backdoor Execution
id: 2fdefcb3-dbda-401e-ae23-f0db027628bc
related:
    - id: baca5663-583c-45f9-b5dc-ea96a22ce542
      type: derived
status: test
description: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
references:
    - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
date: 2018-03-15
modified: 2023-03-07
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.008
    - car.2014-11-003
    - car.2014-11-008
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\winlogon.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
            - '\wt.exe'
        CommandLine|contains:
            - 'sethc.exe'
            - 'utilman.exe'
            - 'osk.exe'
            - 'Magnify.exe'
            - 'Narrator.exe'
            - 'DisplaySwitch.exe'
    condition: selection
falsepositives:
    - Unlikely
level: critical

KQL (Azure Sentinel)

imProcessCreate
| where (ParentProcessName endswith "\\winlogon.exe" or ActingProcessName endswith "\\winlogon.exe") and (TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\mshta.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe" or TargetProcessName endswith "\\regsvr32.exe" or TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\wscript.exe" or TargetProcessName endswith "\\wt.exe") and (TargetProcessCommandLine contains "sethc.exe" or TargetProcessCommandLine contains "utilman.exe" or TargetProcessCommandLine contains "osk.exe" or TargetProcessCommandLine contains "Magnify.exe" or TargetProcessCommandLine contains "Narrator.exe" or TargetProcessCommandLine contains "DisplaySwitch.exe")

Required Data Sources

False Positive Guidance

• Unlikely

MITRE ATT&CK Context

• Tactic: Privilege Escalation
• Tactic: Persistence
• Technique: T1546.008 — T1546.008

References

• https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
• SigmaHQ Rule