Windows Sticky Keys Backdoor Persistence via sethc.exe Replaced with cmd.exe

Flags forced replacement of C:\Windows\System32\sethc.exe with cmd.exe consistent with a Sticky Keys backdoor.

FreeUnreviewedSigmacriticalv1

windows-sticky-keys-backdoor-persistence-via-sethc-exe-replaced-with-cmd-exe-1070db9a

title: Windows Sticky Keys Backdoor Persistence via sethc.exe Replaced with cmd.exe
id: 288a35cd-7fbf-4bc0-b2b3-7216d12689b4
status: test
description: This rule matches process creation where the command line includes a forced copy that places cmd.exe in place of the Sticky Keys binary (sethc.exe). By triggering Sticky Keys, an attacker can spawn a privileged Windows console session without authenticating, enabling persistence and potential privilege escalation. Telemetry relies on Windows process creation records containing command-line arguments showing the specific copy operation to sethc.exe.
references:
  - https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html
  - https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf
  - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml
author: Sreeman, Huntrule Team
date: 2020-02-18
modified: 2023-03-07
tags:
  - attack.persistence
  - attack.t1546.008
  - attack.privilege-escalation
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - "copy "
      - "/y "
      - C:\windows\system32\cmd.exe C:\windows\system32\sethc.exe
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 1070db9a-3e5d-412e-8e7b-7183b616e1b3
    type: derived

What it detects

This rule matches process creation where the command line includes a forced copy that places cmd.exe in place of the Sticky Keys binary (sethc.exe). By triggering Sticky Keys, an attacker can spawn a privileged Windows console session without authenticating, enabling persistence and potential privilege escalation. Telemetry relies on Windows process creation records containing command-line arguments showing the specific copy operation to sethc.exe.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.