Command Launched from WinLogon

Hypothesis and description

An adversary can use accessibility features (Ease of Access), such as StickyKeys or Utilman, to launch a command shell from the logon screen and gain SYSTEM access. Since an adversary does not have physical access to the machine, this technique must be run within Remote Desktop. To prevent an adversary from getting to the login screen without first authenticating, Network-Level Authentication (NLA) must be enabled. If a debugger is set up for one of the accessibility features, then it will intercept the process launch of the feature and instead execute a new command line. This analytic looks for instances of cmd.exe or powershell.exe launched directly from the logon process, winlogon.exe. It should be used in tandem with CAR-2014-11-003, which detects the accessibility programs in the command line.

Several accessibility programs can be run using the Ease of Access center

- sethc.exe handles StickyKeys

- utilman.exe is the Ease of Access menu

- osk.exe runs the On-Screen Keyboard

- narrator.exe reads screen text over audio

- magnify.exe magnifies the view of the screen near the cursor

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2014-11-19
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1546 Event Triggered ExecutionT1546.008	Privilege Escalation, Persistence	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1546Event Triggered Execution
.008 Accessibility Features

D3FEND techniques MITRE maps to this analytic

D3-PLA Process Lineage Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

Look for instances of processes where the parent executable is winlogon.exe and the child is an instance of a command prompt.

processes = search Process:Create
winlogon_cmd = filter processes where (parent_exe == "winlogon.exe" and exe == "cmd.exe")
output winlogon_cmd

SplunkData model: Sysmon native

Splunk version of the above pseudocode.

index=__your_sysmon_index__ EventCode=1 ParentImage="C:\\Windows\\*\\winlogon.exe" Image="C:\\Windows\\*\\cmd.exe"

EQLData model: EQL native

EQL version of the above pseudocode.

process where subtype.create and
  (process_name == "cmd.exe" and parent_process_name == "winlogon.exe")

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 parent_image="C:\Windows\System32\winlogon.exe" parent_image="C:\Windows\System32\cmd.exe"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

38 more in the full list

View CAR-2014-11-008 on car.mitre.org