Detectionmediumtest

Uncommon Assistive Technology Applications Execution Via AtBroker.EXE

Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Mateusz Wydra, oscd.communityCreated Mon Oct 12Updated Wed Mar 06f24bcaea-0cd1-11eb-adc1-0242ac120002windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\AtBroker.exe'
        - OriginalFileName: 'AtBroker.exe'
    selection_cli:
        CommandLine|contains: 'start'
    filter_main_builtin:
        CommandLine|contains:
            - 'animations'
            - 'audiodescription'
            - 'caretbrowsing'
            - 'caretwidth'
            - 'colorfiltering'
            - 'cursorindicator'
            - 'cursorscheme'
            - 'filterkeys'
            - 'focusborderheight'
            - 'focusborderwidth'
            - 'highcontrast'
            - 'keyboardcues'
            - 'keyboardpref'
            - 'livecaptions'
            - 'magnifierpane'
            - 'messageduration'
            - 'minimumhitradius'
            - 'mousekeys'
            - 'Narrator'
            - 'osk'
            - 'overlappedcontent'
            - 'showsounds'
            - 'soundsentry'
            - 'speechreco'
            - 'stickykeys'
            - 'togglekeys'
            - 'voiceaccess'
            - 'windowarranging'
            - 'windowtracking'
            - 'windowtrackingtimeout'
            - 'windowtrackingzorder'
    filter_optional_java:
        CommandLine|contains: 'Oracle_JavaAccessBridge'
    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*