Windows Backdoor Execution via Sticky Keys and Login-Screen Accessibility Tools

Flags winlogon.exe spawning command/script tools referencing login-screen accessibility binaries (sethc.exe, utilman.exe, osk.exe, etc.).

FreeReviewedSigma · Critical · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
Published: 2018-03-15
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546.008Accessibility Features
Priv Esc
- T1546.008Accessibility Features
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where a debugger-like payload is launched from cmd.exe or script/utility interpreters while the parent process is winlogon.exe, and the command line references built-in accessibility executables. Attackers can abuse login-screen accessible tools such as sethc.exe, utilman.exe, and other narrator/magnifier utilities to persistently trigger malicious code during interactive logon. The detection relies on Windows process creation telemetry, specifically parent image path, child image path, and command line contents.

Reporting behind it

Related detections9 linkedT1546.008 — drag to rearrange

Malicious Sticky Key File Created from CMD Copy (via file_event)

Malicious Stickey Key Called CMD via Command Execution - Hash Detection (via process_creation)

Malicious Stickey Key IFEO Registry Changed - Reg via Sysmon (via registry_event)

Malicious Accessibility Feature Backdoor via Image File Execution Options Debugger (via registry_set)

Malicious Stickey Key Called CMD via Command Execution (via process_creation)

Malicious Sticky Key Sethc Command for Replacement by CMD (via process_creation)

Malicious Stickey Key IFEO - Reg via Command (via process_creation)

Malicious Accessibility Feature Debugger Hijack via IFEO (via registry_set)

Windows Privilege Escalation via mklink Symlink Between cmd.exe and osk.exe

Windows Backdoor Execution via Sticky Keys and Login-Screen Accessibility Tools

Pivot detection · T1546.008 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-sticky-keys-backdoor-winlogon-launched-scripting-tool-execution-targetin-2fdefcb3

title: Windows Backdoor Execution via Sticky Keys and Login-Screen Accessibility Tools
id: 8ade2d74-def9-4b0e-8e7d-c455a957064f
related:
  - id: baca5663-583c-45f9-b5dc-ea96a22ce542
    type: derived
  - id: 2fdefcb3-dbda-401e-ae23-f0db027628bc
    type: derived
status: test
description: This rule flags process creation where a debugger-like payload is launched from cmd.exe or script/utility interpreters while the parent process is winlogon.exe, and the command line references built-in accessibility executables. Attackers can abuse login-screen accessible tools such as sethc.exe, utilman.exe, and other narrator/magnifier utilities to persistently trigger malicious code during interactive logon. The detection relies on Windows process creation telemetry, specifically parent image path, child image path, and command line contents.
references:
  - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml
author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2018-03-15
modified: 2023-03-07
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.008
  - car.2014-11-003
  - car.2014-11-008
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \winlogon.exe
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wscript.exe
      - \wt.exe
    CommandLine|contains:
      - sethc.exe
      - utilman.exe
      - osk.exe
      - Magnify.exe
      - Narrator.exe
      - DisplaySwitch.exe
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL