LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Atbroker.exe

View source

Helper binary for Assistive Technology (AT)

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Start a registered Assistive Technology (AT).

COMMAND
ATBroker.exe /start malware
USE CASE
Executes code defined in registry for a new AT. Modifications must be made to the system registry to either register or modify an existing Assistive Technology (AT) service entry.
PRIVILEGES
User
OPERATING SYSTEM
Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

C:\Windows\System32\Atbroker.exe
C:\Windows\SysWOW64\Atbroker.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    Changes to HKCU\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration

  • IOC

    Changes to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs

  • IOC

    Unknown AT starting C:\Windows\System32\ATBroker.exe /start malware

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Adam@hexacorn