LOLBAS/yml/OSBinaries/Atbroker.yml

21 lines
581 B
YAML

---
Name: Atbroker.exe
Description: Execute
Author: ''
Created: '2018-05-25'
Categories: []
Commands:
- Command: ATBroker.exe /start malware
Description: Start a registered Assistive Technology (AT).
Full Path:
- C:\Windows\System32\Atbroker.exe
- C:\Windows\SysWOW64\Atbroker.exe
Code Sample: []
Detection: []
Resources:
- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
Notes: >
Thanks to Adam - @hexacorn
Modifications must be made to the system registry to either register or modify an existing Assistibe Technology (AT) service entry.