Suspicious Atbroker Registry Change (via registry_event)

title: Suspicious Atbroker Registry Change (via registry_event)
id: bb875f6c-9ee8-5bdb-b9d8-d9917b1be6c9
status: stable
description: This rule detects creation/modification of Assistive Technology applications and persistence with use of 'at'
references:
    - https://attack.mitre.org/techniques/T1547/
    - https://attack.mitre.org/techniques/T1218/
    - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
    - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/
author: Huntrule Team
date: 2026-05-30
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1218
    - attack.persistence
    - attack.t1547
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs'
            - 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration'
    filter_atbroker:
        Image: 'C:\Windows\system32\atbroker.exe'
        TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration'
        Details: '(Empty)'
    filter_uninstallers:
        Image|startswith: 'C:\Windows\Installer\MSI'
        TargetObject|contains: 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs'
    condition: selection and not 1 of filter_*
falsepositives:
    - Unknown
level: medium