Accessibility Features abuse (MITRE ATT&CK T1546.008) is a Windows persistence and privilege escalation technique. Windows includes accessibility tools that can be launched with a key combination before anyone has logged in, for example from the logon screen. If an adversary changes how those tools start, a command prompt or backdoor can appear without a login.
How attackers use it
Two well known programs are C:\Windows\System32\sethc.exe, launched by pressing Shift five times (Sticky Keys), and C:\Windows\System32\utilman.exe, launched with the Windows key and U. MITRE notes sethc.exe has been used for unauthenticated access through a remote desktop login screen.
How it works depends on the Windows version. Common methods are replacing the accessibility binary, or replacing pointers to it in the registry. On newer versions of Windows, a replaced binary has to be digitally signed for x64 systems, has to sit in %systemdir%\ and has to be protected by Windows File or Resource Protection. MITRE says the Image File Execution Options debugger method (T1546.012) was likely found as a workaround, since it does not require replacing the binary.
For simple replacement, a program such as utilman.exe might be swapped for cmd.exe or another program that gives backdoor access. Pressing the key combination at the login screen, at the keyboard or over Remote Desktop Protocol, then runs the replaced file with SYSTEM privileges.
MITRE lists other accessibility programs that can be used the same way:
- On-Screen Keyboard,
C:\Windows\System32\osk.exe. - Magnifier,
C:\Windows\System32\Magnify.exe. - Narrator,
C:\Windows\System32\Narrator.exe. - Display Switcher,
C:\Windows\System32\DisplaySwitch.exe. - App Switcher,
C:\Windows\System32\AtBroker.exe.
How to detect it
MITRE's strategy is a behavior chain:
- Replacement or tampering of accessibility binaries such as utilman.exe, sethc.exe or osk.exe.
- Registry changes that redirect those programs, such as Image File Execution Options keys.
- cmd.exe or another unexpected binary started from the login screen by SYSTEM.
File integrity monitoring on the binaries is cheap and effective, since they should only change with Windows updates. Process creation logs that show cmd.exe with a parent related to winlogon or an accessibility tool are a strong signal.
How to reduce the risk
MITRE lists three mitigations:
- Use a Remote Desktop Gateway. Where possible, manage RDP connections through a gateway and tighten RDP security configuration.
- Require Network Level Authentication. To use this technique remotely, an adversary has to combine it with RDP. NLA forces authentication before the session is created and the login screen shows. It is on by default on Windows Vista and later.
- Use application control. Tools such as Windows Defender Application Control and AppLocker can identify and block software started through accessibility functions.
Check your own environment
Read-only commands in a Windows command prompt:
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /s /v Debugger
certutil -hashfile C:\Windows\System32\utilman.exe SHA256
certutil -hashfile C:\Windows\System32\sethc.exe SHA256
The first shows any debugger values, which should be absent for accessibility programs. The hash commands let you compare against a known good copy of the same Windows build. Then ask:
- Is NLA enforced on every host that allows RDP?
- Are RDP hosts reachable only through a gateway or VPN?
- Do you monitor the accessibility binaries for change?
- Is application control blocking cmd.exe from unexpected parents?
Quick check
Why is NLA a mitigation here?
An attacker using this technique remotely needs the login screen. NLA requires authentication first, so the screen, and the Sticky Keys shortcut on it, is not reachable without credentials.
Which other technique achieves the same result without replacing the binary?
Image File Execution Options injection (T1546.012), which sets a debugger value in the registry for the accessibility program.
