CmdID

CmdID / Techniques / T1546

T1546.008 Event Triggered Execution: Accessibility Features

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. MITRE ATT&CK

1 program on CmdID 5 Sigma rules T1546.008 on attack.mitre.org

Part of

MITRE ATT&CK
T1546Event Triggered Execution

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
cmd.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
criticalPersistence Via Sticky Key BackdoorSreeman · Windows
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community · Windows
highPotential Privilege Escalation Using Symlink Between Osk and Cmdfrack113 · Windows
highSuspicious Debugger Registration CmdlineFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · Windows
mediumPotential Suspicious Activity Using SeCEditJanantha Marasinghe · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To incorporate changes required by the analysis process on the SecContoso.inf file, and then to direct the output to the existing file, SecAnalysisContosoFY11, without prompting, type on the page for secedit configure

secedit /configure /db C:\Security\FY11\SecDbContoso.sdb /cfg SecContoso.inf /overwrite /log C:\Security\FY11\SecAnalysisContosoFY11.xml /quietIdentify

To export the security database and the domain security policies to an inf file, and then import that file to a different database in order to replicate the security policy settings on another computer, type on the page for secedit export

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

To export the security database and the domain security policies to an .inf file, and then to import that file to a different database to replicate the policy settings on another computer, type on the page for secedit import

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg NetworkShare\Policies\SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

An example is here when CmdID’s reading of it names T1546.008: a Sigma rule it trips is tagged with it, or its abuse is documented as it.