T1546.008 — Accessibility Features
Tactics: Privilege Escalation, Persistence · Platforms: Windows
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An…
Sub-technique of Event Triggered Execution (T1546).
Sigma detection rules (1)
T1546.008 Event Triggered Execution: Accessibility Features
title: "T1546.008 Event Triggered Execution: Accessibility Features"
id: e2ff1954-df43-4119-86b2-cf2ca3b7757f
description: 'Detection Strategy for Accessibility Feature Hijacking via Binary Replacement or Registry Modification. (Retargeted from the original process_creation label to file_event — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TimeWindow, TargetBinaryNames, ParentProcess, UserContext, CommandLineContains.'
references:
- https://attack.mitre.org/techniques/T1546/008
author: Shahrukh Khan
date: 2026-01-30
license: MIT
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.008
logsource:
category: file_event
product: windows
service: sysmon
detection:
selection:
TargetFilename|endswith: 'sethc.exe'
TargetFilename|contains: '\System32\'
condition: selection
falsepositives:
- Legitimate replacement of sethc.exe practically never happens outside a Windows update; this is a high-confidence indicator of the Accessibility Features backdoor technique.
level: critical
Related sub-techniques
Explore