huntrule

Windows Sticky Keys Backdoor: Winlogon-Launched Scripting Tool Execution Targeting SetHC/Utilman

Flags winlogon.exe spawning command/script tools referencing login-screen accessibility binaries (sethc.exe, utilman.exe, osk.exe, etc.).

FreeUnreviewedSigmacriticalv1
title: "Windows Sticky Keys Backdoor: Winlogon-Launched Scripting Tool Execution Targeting SetHC/Utilman"
id: 8ade2d74-def9-4b0e-8e7d-c455a957064f
related:
  - id: baca5663-583c-45f9-b5dc-ea96a22ce542
    type: derived
  - id: 2fdefcb3-dbda-401e-ae23-f0db027628bc
    type: derived
status: test
description: This rule matches process creation on Windows where winlogon.exe launches common command and scripting binaries (cmd.exe, PowerShell, mshta, regsvr32, rundll32, and others) with command lines referencing built-in accessibility utilities like sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, and DisplaySwitch.exe. Attackers can abuse these login-screen accessible executables to execute malicious payloads with elevated context, effectively providing persistence and potential privilege escalation. It relies on process creation telemetry, including ParentImage, Image, and CommandLine content.
references:
  - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml
author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2018-03-15
modified: 2023-03-07
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.008
  - car.2014-11-003
  - car.2014-11-008
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \winlogon.exe
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wscript.exe
      - \wt.exe
    CommandLine|contains:
      - sethc.exe
      - utilman.exe
      - osk.exe
      - Magnify.exe
      - Narrator.exe
      - DisplaySwitch.exe
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1

What it detects

This rule matches process creation on Windows where winlogon.exe launches common command and scripting binaries (cmd.exe, PowerShell, mshta, regsvr32, rundll32, and others) with command lines referencing built-in accessibility utilities like sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, and DisplaySwitch.exe. Attackers can abuse these login-screen accessible executables to execute malicious payloads with elevated context, effectively providing persistence and potential privilege escalation. It relies on process creation telemetry, including ParentImage, Image, and CommandLine content.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.