T1546.008: Accessibility Features
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. [1]
Depending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\, and it must be protected by Windows File or Resource Protection (WFP/WRP). [2] The Image File Execution Options Injection debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.
For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over Remote Desktop Protocol will cause the replaced file to be executed with SYSTEM privileges. [3]
Other accessibility features exist that may also be leveraged in a similar fashion: [2][4]
* On-Screen Keyboard: C:\Windows\System32\osk.exe * Magnifier: C:\Windows\System32\Magnify.exe * Narrator: C:\Windows\System32\Narrator.exe * Display Switcher: C:\Windows\System32\DisplaySwitch.exe * App Switcher: C:\Windows\System32\AtBroker.exe
Analyst context for executives and security teams
This Windows technique matters because it can turn built-in accessibility shortcuts at the logon screen into a persistence or privilege-escalation path. If accessibility binaries or their launch references are altered, an adversary may be able to trigger a command prompt or backdoor before normal user logon, including through Remote Desktop scenarios described by ATT&CK. For leaders, the practical issue is whether Windows hardening, file integrity monitoring, registry monitoring, and remote access controls would expose or prevent this kind of pre-logon abuse.
Executive priority
Prioritize this where Windows servers, administrator workstations, jump hosts, or RDP-accessible systems are important to business operations. The risk is not just malware execution; it is persistence and potential SYSTEM-level access through trusted OS functionality. Security leaders should ask whether endpoint baselines protect accessibility feature binaries, whether registry changes tied to launch behavior are monitored, whether RDP exposure is tightly controlled, and whether evidence exists for audit and incident response review.
Technical view
ATT&CK identifies this as a Windows sub-technique of Event Triggered Execution used for persistence and privilege escalation. Defensive validation should focus on unauthorized replacement or modification of accessibility-related binaries such as sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, DisplaySwitch.exe, and AtBroker.exe, plus registry-based pointer or debugger-style launch changes associated with these programs. Because MITRE provides no official detection text for this object, teams should align validation to the related detection strategy DET0033 and test whether endpoint, file integrity, registry, and remote logon telemetry can distinguish authorized OS files from suspicious replacement or redirection.
Likely telemetry
- Windows file creation, modification, rename, and hash/signature telemetry for accessibility binaries under C:\Windows\System32
- Registry change telemetry for launch references or debugger-style redirection involving accessibility feature executables
- Process execution telemetry showing accessibility feature names spawning unexpected shells, tools, or backdoor-like processes
- Windows logon and Remote Desktop authentication/session telemetry around pre-logon or remote access activity
- Endpoint protection or application control events for unsigned, unexpected, or unauthorized binaries in protected system paths
Detection direction
- Validate coverage against DET0033: binary replacement and registry modification are the core detection angles supported by the relationship context.
- Baseline expected hashes, signatures, paths, and parent-child process behavior for the listed accessibility executables; alert on drift from the approved OS image.
- Tune for high-signal combinations, such as accessibility executables launching command interpreters or unexpected programs, or registry changes followed by RDP/logon-screen access.
- Account for false positives from legitimate OS servicing, accessibility configuration, and administrative repair activity by correlating with change tickets, patch windows, and trusted installers.
- Check blind spots on systems with limited EDR visibility, weak registry auditing, incomplete file integrity monitoring, or exposed RDP paths.
Mitigation priorities
- Harden Windows operating system configuration consistent with M1028, including protecting default OS configuration and reducing abuse of built-in functionality.
- Use execution prevention controls consistent with M1038 so only trusted and authorized code can run, especially from sensitive system locations.
- Limit access to remote systems and services consistent with M1035, with particular attention to RDP-accessible hosts and administrative systems.
- Maintain configuration baselines for protected Windows binaries and registry locations, then investigate unauthorized deviation quickly.
- Include this behavior in incident response playbooks for Windows persistence review, especially on systems where privileged access or remote logon exposure is material.
Analyst notes and limits
ATT&CK relates this technique to multiple groups and software, including Axiom, Deep Panda, APT29, APT3, APT41, Fox Kitten, and Empire. Use that as threat-intelligence context for prioritization, not as proof of current activity in any environment. The revoked older technique T1015 maps into this sub-technique, so historical detections and reports may use the older identifier.
The official ATT&CK object does not provide detection guidance, and the supplied mitigation descriptions are general. Local conclusions require host configuration data, endpoint telemetry quality, RDP exposure review, registry auditing status, and change-management context. This take is limited to Windows because that is the only platform supplied for the object.
Accessibility Features
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. [1]
Depending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\, and it must be protected by Windows File or Resource Protection (WFP/WRP). [2] The Image File Execution Options Injection debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.
For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over Remote Desktop Protocol will cause the replaced file to be executed with SYSTEM privileges. [3]
Other accessibility features exist that may also be leveraged in a similar fashion: [2][4]
* On-Screen Keyboard: C:\Windows\System32\osk.exe * Magnifier: C:\Windows\System32\Magnify.exe * Narrator: C:\Windows\System32\Narrator.exe * Display Switcher: C:\Windows\System32\DisplaySwitch.exe * App Switcher: C:\Windows\System32\AtBroker.exe
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1015 | Accessibility Features | Accessibility Features revoked by this object. |
| Enterprise | T1546 | Event Triggered Execution | This object subtechnique of Event Triggered Execution. |
Groups, software, and campaigns
G0096: APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]
G0022: APT3
APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.[1][2] This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.[1][3] As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.[4]
G0009: Deep Panda
Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. [1] The intrusion into healthcare company Anthem has been attributed to Deep Panda. [2] This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. [3] Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. [4] Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same. [5]
G0001: Axiom
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.[1][2][3]
G0117: Fox Kitten
Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]
G0016: APT29
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]
S0363: Empire
Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 31faa9d040f4… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
FireEye Hikit Rootkit
Glyer, C., Kazanciyan, R. (2012, August 20). The “Hikit” Rootkit: Advanced and Persistent Attack Techniques (Part 1). Retrieved November 17, 2024.
Open source URL -
[2]
DEFCON2016 Sticky Keys
Maldonado, D., McGuffin, T. (2016, August 6). Sticky Keys to the Kingdom. Retrieved July 5, 2017.
Open source URL -
[3]
Tilbury 2014
Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse. Retrieved November 17, 2024.
Open source URL -
[4]
Narrator Accessibility Abuse
Comi, G. (2019, October 19). Abusing Windows 10 Narrator's 'Feedback-Hub' URI for Fileless Persistence. Retrieved April 28, 2020.
Open source URL -
[5]
mitre-attack T1546.008Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.