Windows Execution of Assistive Technology App via AtBroker.EXE (Non-Built-In)

Alerts on Windows process starts of AtBroker.exe with "start" that don’t match known built-in accessibility parameters.

FreeUnreviewedSigmamediumv1

windows-execution-of-assistive-technology-app-via-atbroker-exe-non-built-in-f24bcaea

title: Windows Execution of Assistive Technology App via AtBroker.EXE (Non-Built-In)
id: 4b59431c-045a-48a8-863f-03372f70da10
status: test
description: This rule flags process creation where AtBroker.exe is started with a command line containing "start". It focuses on executions that do not match a list of common built-in assistive technology parameters, which can make unexpected accessibility app launches stand out. Telemetry required is Windows process creation, including the image path, OriginalFileName, and command line content.
references:
  - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
  - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_atbroker_uncommon_ats_execution.yml
author: Mateusz Wydra, oscd.community, Huntrule Team
date: 2020-10-12
modified: 2024-03-06
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \AtBroker.exe
    - OriginalFileName: AtBroker.exe
  selection_cli:
    CommandLine|contains: start
  filter_main_builtin:
    CommandLine|contains:
      - animations
      - audiodescription
      - caretbrowsing
      - caretwidth
      - colorfiltering
      - cursorindicator
      - cursorscheme
      - filterkeys
      - focusborderheight
      - focusborderwidth
      - highcontrast
      - keyboardcues
      - keyboardpref
      - livecaptions
      - magnifierpane
      - messageduration
      - minimumhitradius
      - mousekeys
      - Narrator
      - osk
      - overlappedcontent
      - showsounds
      - soundsentry
      - speechreco
      - stickykeys
      - togglekeys
      - voiceaccess
      - windowarranging
      - windowtracking
      - windowtrackingtimeout
      - windowtrackingzorder
  filter_optional_java:
    CommandLine|contains: Oracle_JavaAccessBridge
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate, non-default assistive technology applications execution
level: medium
license: DRL-1.1
related:
  - id: f24bcaea-0cd1-11eb-adc1-0242ac120002
    type: derived

What it detects

This rule flags process creation where AtBroker.exe is started with a command line containing "start". It focuses on executions that do not match a list of common built-in assistive technology parameters, which can make unexpected accessibility app launches stand out. Telemetry required is Windows process creation, including the image path, OriginalFileName, and command line content.

Known false positives

Legitimate, non-default assistive technology applications execution

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.