T1546.008PersistencePrivilege Escalation
Accessibility Features
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
6 Sigma rules tagged T1546.008Accessibility FeaturesT1546.0086 general rules
- Persistence Via Sticky Key Backdoorcriticaltest
- Sticky Key Like Backdoor Executioncriticaltest
- Sticky Key Like Backdoor Usage - Registrycriticaltest
- Potential Privilege Escalation Using Symlink Between Osk and Cmdhightest
- Suspicious Debugger Registration Cmdlinehightest
- Potential Suspicious Activity Using SeCEditmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Accessibility Features
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.