Windows Process Creation: Sticky Keys Backdoor via sethc.exe Replacement

Flags forced replacement of C:\Windows\System32\sethc.exe with cmd.exe consistent with a Sticky Keys backdoor.

FreeReviewedSigma · Critical · v2

Product: windows
Category: process_creation
Author: Sreeman (SigmaHQ), DRL 1.1
Published: 2020-02-18
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546.008Accessibility Features
Priv Esc
- T1546.008Accessibility Features
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches a command line that copies cmd.exe over sethc.exe using overwrite flags, which is consistent with a sticky keys backdoor persistence technique that grants privileged console access. Attackers use this to trigger a privileged shell through accessibility shortcut behavior without providing additional authentication. The detection relies on Windows process creation telemetry with full command-line content containing the specific copy sequence to sethc.exe.

Reporting behind it

Related detections9 linkedT1546.008 — drag to rearrange

Malicious Sticky Key File Created from CMD Copy (via file_event)

Malicious Stickey Key Called CMD via Command Execution - Hash Detection (via process_creation)

Malicious Stickey Key IFEO Registry Changed - Reg via Sysmon (via registry_event)

Malicious Accessibility Feature Backdoor via Image File Execution Options Debugger (via registry_set)

Malicious Stickey Key Called CMD via Command Execution (via process_creation)

Malicious Sticky Key Sethc Command for Replacement by CMD (via process_creation)

Malicious Stickey Key IFEO - Reg via Command (via process_creation)

Malicious Accessibility Feature Debugger Hijack via IFEO (via registry_set)

Windows Privilege Escalation via mklink Symlink Between cmd.exe and osk.exe

Windows Process Creation: Sticky Keys Backdoor via sethc.exe Replacement

Pivot detection · T1546.008 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-sticky-keys-backdoor-persistence-via-sethc-exe-replaced-with-cmd-exe-1070db9a

title: "Windows Process Creation: Sticky Keys Backdoor via sethc.exe Replacement"
id: 288a35cd-7fbf-4bc0-b2b3-7216d12689b4
status: test
description: This rule matches a command line that copies cmd.exe over sethc.exe using overwrite flags, which is consistent with a sticky keys backdoor persistence technique that grants privileged console access. Attackers use this to trigger a privileged shell through accessibility shortcut behavior without providing additional authentication. The detection relies on Windows process creation telemetry with full command-line content containing the specific copy sequence to sethc.exe.
references:
  - https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html
  - https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf
  - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml
author: Sreeman, Huntrule Team
date: 2020-02-18
modified: 2023-03-07
tags:
  - attack.persistence
  - attack.t1546.008
  - attack.privilege-escalation
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - "copy "
      - "/y "
      - C:\windows\system32\cmd.exe C:\windows\system32\sethc.exe
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 1070db9a-3e5d-412e-8e7b-7183b616e1b3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL