Accessibility binary hijacked via Image File Execution Options

Siemphony@siemphonyhighT1546.008unverified

Matches a registry value written under an Image File Execution Options subkey named after one of the accessibility binaries reachable from the logon screen, which is the redirection half of MITRE's AN0094. Both conditions are tested on TargetObject because a single Sysmon EventID 13 record carries the full key path — the IFEO prefix and the hijacked binary name are two substrings of the same value, so requiring both keeps unrelated IFEO writes out. The other half of the analytic, cmd.exe spawned by winlogon.exe as SYSTEM shortly after the key changed, is a two-event correlation over MITRE's TimeWindow knob and cannot be expressed in Sigma, so it is not attempted here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0033, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey contains "\\Image File Execution Options\\" and (RegistryKey contains "\\sethc.exe" or RegistryKey contains "\\utilman.exe" or RegistryKey contains "\\osk.exe" or RegistryKey contains "\\magnify.exe" or RegistryKey contains "\\narrator.exe" or RegistryKey contains "\\displayswitch.exe" or RegistryKey contains "\\atbroker.exe" or RegistryKey contains "\\hh.exe"))

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Image File Execution Options\\*" AND (TargetObject="*\\sethc.exe*" OR TargetObject="*\\utilman.exe*" OR TargetObject="*\\osk.exe*" OR TargetObject="*\\magnify.exe*" OR TargetObject="*\\narrator.exe*" OR TargetObject="*\\displayswitch.exe*" OR TargetObject="*\\atbroker.exe*" OR TargetObject="*\\hh.exe*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\image file execution options\\\\*" AND (TO_LOWER(registry.path) LIKE "*\\\\sethc.exe*" OR TO_LOWER(registry.path) LIKE "*\\\\utilman.exe*" OR TO_LOWER(registry.path) LIKE "*\\\\osk.exe*" OR TO_LOWER(registry.path) LIKE "*\\\\magnify.exe*" OR TO_LOWER(registry.path) LIKE "*\\\\narrator.exe*" OR TO_LOWER(registry.path) LIKE "*\\\\displayswitch.exe*" OR TO_LOWER(registry.path) LIKE "*\\\\atbroker.exe*" OR TO_LOWER(registry.path) LIKE "*\\\\hh.exe*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)\\Image File Execution Options\\</field>    <field name="TargetObject" type="pcre2">(?i)(\\sethc\.exe|\\utilman\.exe|\\osk\.exe|\\magnify\.exe|\\narrator\.exe|\\displayswitch\.exe|\\atbroker\.exe|\\hh\.exe)</field>    <description>Accessibility binary hijacked via Image File Execution Options</description>    <mitre>      <id>T1546.008</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c48a6f21-0b93-4d7e-9a16-5f2c8e70b4d3

ATT&CKT1546.008

T1546.008Accessibility Features

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A registry value written under an Image File Execution Options subkey named after an accessibility binary reachable from the logon screen. IFEO is a debugging feature: set a Debugger value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe and Windows launches your program instead whenever sethc.exe is invoked. Press shift five times at the locked logon screen and you get that program, running as SYSTEM, before anyone has authenticated. That is the whole technique in one registry write, and it is why this rule is level: high despite touching only one field. MITRE's AN0094 pairs the redirection with its consequence — cmd.exe spawned by winlogon.exe as SYSTEM shortly after the key changed. That is a two-event correlation over MITRE's TimeWindow knob and Sigma cannot express it, so the rule takes the redirection half alone.

02 · Telemetry you need

Sysmon EventID 13 (registry_set). TargetObject carries the full key path.
A Sysmon config that actually includes the IFEO key. It is in most public
To reach the second half of AN0094 later: Sysmon EventID 1 with ParentImage

03 · How the logic works

Two selections, both on the same field, AND-ed:

This is the construction worth studying. A single Sysmon 13 record carries the entire key path in one string, so the IFEO prefix and the hijacked binary name are two substrings of the same value. Requiring both is what keeps ordinary IFEO writes — of which there are many — out of the results, while a bare '\Image File Execution Options\' would match every one of them and a bare '\sethc.exe' would match any registry path mentioning it. Neither half is a detection; the intersection is. The binary list is MITRE's `TargetBinaryNames` knob populated by the author. MITRE names the knob and gives two examples, utilman.exe and sethc.exe; the other six are the author's expansion. osk.exe, magnify.exe, narrator.exe, displayswitch.exe and atbroker.exe are all reachable from the Ease of Access path at the logon screen, so they are defensible. hh.exe is not — the HTML Help viewer is not an accessibility feature and is not reachable pre-authentication. IFEO on hh.exe is generic IFEO injection, which is T1546.012, so its presence quietly imports a neighbouring sub-technique into a rule tagged only attack.t1546.008. Two gaps the reviewer found, and both matter more than the logic does. The rule does not cover binary replacement. The classic form of this sub-technique — the one MITRE's own technique text leads with — is copying cmd.exe over C:\Windows\System32\sethc.exe. AN0094's first log source is Sysmon EventID 11 for exactly that. It is a single event and trivially expressible (file_event, TargetFilename|endswith: '\sethc.exe'), yet no rule here covers it, and the description names only the correlation as the missing piece. Do not read that as "the sticky-keys swap needs a correlation engine." It does not. It needs a second rule that nobody wrote. `SilentProcessExit` walks straight past it. selection_ifeo requires the literal '\Image File Execution Options\'. The sibling mechanism — HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\sethc.exe with ReportingMode and MonitorProcess — achieves the same launch-my-binary outcome, is documented by Microsoft, is in common offensive tooling, and contains none of that substring. Same technique, same target binary, one different key path, zero matches. When a rule anchors on a mechanism's name rather than its effect, the sibling mechanism is always the first thing to check.

04 · Common false positives

Exploit Protection / Defender Exploit Guard is the one to expect. Its
A developer or support engineer attaching a debugger via gflags or windbg while
Application Verifier or a QA imaging step setting GlobalFlag across a broad

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0033 and never executed against a log line. level: high reflects that an AND across two substrings of the same key path is a genuinely tight join, not a measured precision. As with the other registry rules in this corpus, translations.json records a Sentinel refusal — no table is modelled for registry_set/windows — while Splunk, Elastic and Wazuh render.
tier_2: confirm Sysmon is capturing the IFEO key at all, run the rule over historical registry data, and identify whether your Exploit Protection policy touches any accessibility binary.
tier_3: restores AN0094's chain — the registry write joined to winlogon.exe spawning cmd.exe as SYSTEM inside TimeWindow — and that join is the difference between "someone configured a debugger" and "someone opened a SYSTEM shell at the logon screen."

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add '\SilentProcessExit\' as an alternative to selection_ifeo, still ANDed
Author the file_event companion on TargetFilename|endswith: '\sethc.exe'
Remove hh.exe, or add the t1546.012 tag and say why it is there.
Suppress Exploit Protection by the value name being written
MITRE's ParentProcess and UserContext knobs separate the build-host burst

Declared by the author

A developer or support engineer attaching a debugger to an accessibility binary through IFEO, for example gflags or windbg while reproducing a Narrator or Magnifier crash. MITRE's TargetBinaryNames knob is where the monitored set gets narrowed if this is routine on engineering builds.
Assistive-technology products that substitute their own on-screen keyboard or screen reader by redirecting osk.exe or narrator.exe through IFEO at install time. The write is legitimate but structurally identical, so suppress on the installing process rather than removing the binary from the list.
Application Verifier or a QA imaging step enabling GlobalFlag values across a broad sweep of system binaries, which catches the accessibility executables incidentally. These arrive as a burst from one process on a build host, which is what MITRE's UserContext and ParentProcess knobs are meant to separate.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.008, evaluated against their registry_set events.

Share this rule

/u/siemphony/c48a6f21-0b93-4d7e-9a16-5f2c8e70b4d3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Accessibility binary hijacked via Image File Execution Options

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it