Atbroker Registry Change

Title: Atbroker Registry Change
Status: test
Description:Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
References:
  -http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
  -https://lolbas-project.github.io/lolbas/Binaries/Atbroker/
Author: Mateusz Wydra, oscd.community
Date: 2020-10-13
modified:2023-01-19
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1218'
• -'attack.persistence'
• -'attack.t1547'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection:
    TargetObject|contains:
      -'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs'
      -'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration'

  filter_atbroker:
    Image: 'C:\Windows\system32\atbroker.exe'
    TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration'
    Details: '(Empty)'
  filter_uninstallers:
    Image|startswith: 'C:\Windows\Installer\MSI'
    TargetObject|contains: 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs'
  condition:selection and not 1 of filter_*
Falsepositives:
  -Creation of non-default, legitimate at usage
Level: medium