ATT&CK technique
View on MITRE ATT&CK →
T1546.008
Accessibility Features
Privilege EscalationPersistence
9 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Overwriting Accessibility Binaries | production | 2026-10-09 |
| elastic | Potential Modification of Accessibility Binaries | production | 2026-09-18 |
| sigma | Sticky Key Like Backdoor Execution | test | 2023-03-07 |
| sigma | Persistence Via Sticky Key Backdoor | test | 2023-03-07 |
| sigma | Potential Suspicious Activity Using SeCEdit | test | 2022-12-30 |
| sigma | Potential Privilege Escalation Using Symlink Between Osk and Cmd | test | 2022-12-20 |
| sigma | Sticky Key Like Backdoor Usage - Registry | test | 2022-11-26 |
| sigma | Suspicious Debugger Registration Cmdline | test | 2022-08-06 |
| sentinel | Modification of Accessibility Features | Scheduled | — |