-
Notifications
You must be signed in to change notification settings - Fork 797
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
T1015 - Accessibility Features - Possible Fix to Current Hunt #28
Labels
Comments
sahar55
changed the title
T1015 - Accessibility Features - Possibly incorrect hunt
T1015 - Accessibility Features - Possible Fix to Current Hunt
Jan 16, 2019
Hello @sahar55 ! We changed the format a little bit and cleaned some of the playbooks from before. I will add this as a new playbook since I believe the last one was removed while migrating from MD -> YAML -> Notebooks. Thank you for sharing this! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
So I've been examining this hunt/detection and I have attempted to recreate the conditions for this hunt and while doing so I have encountered a possible incorrect logic presented in this hunt.
I may be wrong and if so I'd be happy to learn how to get the desired result.
TL: DR;
1.ParentImage OR ParentProcessName are not the Accessibility program (as suggested in the hunt), but rather the process "winlogon.exe"
2.ParentProcessName is not a field that exists in the event 4688 - "Creator Process Name" is, and only exists since Win10 according to this:
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4688
What I used:
The scenario is this:
I used IFEO to set cmd.exe as a debugger to sethc.exe, then, I used the Sticky-Keys, and other methods to invoke sethc.exe and while reviewing the logs (both Evt and Sysmon) none of them contains the had sethc.exe as a parent of cmd.exe
In addition, if those accessibility features do have a debugger set to them, The analytic proposed shouldn't work since it won't execute the accessibility program.
Am I missing something?
If you need additional details I'd be happy to provide,
looking forward to your answer,
Sahar.
The text was updated successfully, but these errors were encountered: