Tampering with Windows Accessibility Binaries for Privilege Escalation

Adversaries frequently target Windows accessibility features - commonly known as the 'Sticky Keys' attack - to gain unauthorized, high-privilege access to a system. By replacing legitimate accessibility binaries located in C:\Windows\System32, such as sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, DisplaySwitch.exe, and AtBroker.exe, attackers can trigger the execution of malicious code or a command shell at the Windows login screen. This technique effectively bypasses authentication, allowing an attacker to operate with SYSTEM-level privileges. This activity is a classic method for persistence and lateral movement, as it requires only file system write access to sensitive system directories. Defenders must monitor file modifications within the System32 directory to detect unauthorized changes to these binaries.

Attack Chain

1. Attacker gains local administrative or SYSTEM privileges on the target Windows endpoint.
2. Attacker locates the targeted accessibility binary (e.g., C:\Windows\System32\sethc.exe).
3. Attacker takes ownership of the target binary and modifies permissions to allow replacement.
4. Attacker renames or moves the original binary (e.g., to sethc.exe.bak) to avoid detection or disruption.
5. Attacker replaces the original binary with a malicious executable or a copy of cmd.exe.
6. Attacker triggers the accessibility feature (e.g., pressing Shift five times) at the Windows logon screen.
7. The system executes the replaced binary, resulting in an unauthorized SYSTEM-level shell.
8. Attacker proceeds with further malicious activity or credential harvesting.

Impact

Successful exploitation allows for full authentication bypass on the affected Windows system. This provides attackers with persistent, non-authenticated access to the host with SYSTEM-level privileges. This technique is frequently observed in post-compromise scenarios to maintain access across reboots and facilitate deeper environment compromise.

Recommendation

• Monitor all write/modify operations targeting the C:\Windows\System32 directory, specifically for the accessibility binaries listed in this brief.
• Deploy the provided Sigma rule to alert on file creation or modification events matching the targeted binary names.
• Establish a baseline of known-good hashes for all Windows system binaries to identify unauthorized replacements.
• Configure Sysmon Event ID 11 (FileCreate) or equivalent EDR telemetry to log file write activity in the System32 path.
• Investigate any process spawning from the login screen context that is not expected to be a standard accessibility tool.