2018-06-09 00:15:06 +02:00
---
Name : Atbroker.exe
2018-09-24 01:50:14 +02:00
Description : Helper binary for Assistive Technology (AT)
Author : 'Oddvar Moe'
2021-01-10 16:04:52 +01:00
Created : 2018-05-25
2018-06-09 00:15:06 +02:00
Commands :
- Command : ATBroker.exe /start malware
Description : Start a registered Assistive Technology (AT).
2021-12-14 15:57:32 +01:00
Usecase : Executes code defined in registry for a new AT. Modifications must be made to the system registry to either register or modify an existing Assistive Technology (AT) service entry.
2018-09-24 01:50:14 +02:00
Category : Execute
Privileges : User
MitreID : T1218
2021-12-14 16:50:17 +01:00
OperatingSystem : Windows 8, Windows 8.1, Windows 10, Windows 11
2018-12-10 14:28:12 +01:00
Full_Path :
2018-09-24 21:59:43 +02:00
- Path : C:\Windows\System32\Atbroker.exe
- Path : C:\Windows\SysWOW64\Atbroker.exe
2018-09-24 01:50:14 +02:00
Detection :
2023-10-18 17:30:34 +02:00
- Sigma : https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_susp_atbroker.yml
- Sigma : https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml
2022-09-11 07:07:18 +02:00
- IOC : Changes to HKCU\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration
- IOC : Changes to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs
- IOC : Unknown AT starting C:\Windows\System32\ATBroker.exe /start malware
2018-06-09 00:15:06 +02:00
Resources :
2018-09-24 01:50:14 +02:00
- Link : http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
Acknowledgement :
- Person : Adam
Handle : '@hexacorn'
