Accessibility Feature Hijacking (Sticky Keys / Utilman)
Windows ships several accessibility binaries that can be launched before authentication — directly from the logon screen. Because the logon UI runs these binaries with SYSTEM privileges, replacing or redirecting them yields an unauthenticated SYSTEM shell. MITRE ATT&CK tracks this as T1546.008 — Event Triggered Execution: Accessibility Features (Privilege Escalation + Persistence).
The trigger binaries
| Feature | Binary | Trigger |
|---|---|---|
| Sticky Keys | C:\Windows\System32\sethc.exe | Press Shift 5 times |
| Ease of Access (Utility Manager) | C:\Windows\System32\utilman.exe | Win+U or the Ease of Access button |
| On-Screen Keyboard | C:\Windows\System32\osk.exe | Ease of Access menu |
| Magnifier | C:\Windows\System32\Magnify.exe | Ease of Access menu |
| Narrator | C:\Windows\System32\Narrator.exe | Ease of Access menu |
Any of these can be swapped for cmd.exe (or any payload). The classic two are sethc.exe (sticky keys) and utilman.exe, because they have direct, always-available triggers.
Binary replacement
Replacing the binary requires write access to C:\Windows\System32\, which normally means administrator (or an account with SeTakeOwnershipPrivilege). The standard sequence:
# Take ownership of the file (requires admin or SeTakeOwnershipPrivilege)
takeown /f C:\Windows\System32\sethc.exe
# Grant the current user full control so the copy succeeds
icacls C:\Windows\System32\sethc.exe /grant "$env:USERNAME:F"
# Overwrite with cmd.exe
copy C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exeAfter the swap, pressing Shift five times at the logon screen — locally or over an RDP session that has reached the logon UI — pops a cmd.exe running as SYSTEM. The same steps apply to utilman.exe with the Win+U trigger. See icacls for the DACL syntax.
Modern restrictions and the IFEO workaround
On current Windows versions, simple binary replacement is constrained: the replacement must reside in %systemdir%, on x64 it must be digitally signed, and the file is protected by Windows Resource Protection (WRP), which restores tampered System32 binaries. This is why the Image File Execution Options (IFEO) debugger method (T1546.012) became the preferred variant — it leaves the original binary untouched and instead registers a “debugger” under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe that the OS launches instead of the target. The IFEO approach sidesteps WRP entirely.
Defenses
- Network Level Authentication (NLA) on RDP — forces authentication before the logon screen is rendered, so the accessibility triggers can’t be reached remotely without credentials. Enabled by default since Vista. (MITRE M1028)
- Application control (WDAC, AppLocker) to block unsigned binaries launched via accessibility features. (M1038)
- Remote Desktop Gateway to broker and constrain RDP. (M1035)
- Detection: alert on modification/replacement of accessibility binaries, on IFEO keys pointing at them, and on
cmd.exespawning as SYSTEM from the logon session (MITRE DET0033).
In the wild
APT29, APT3, APT41, Deep Panda, and Fox Kitten have all used sticky-keys replacement for persistence or to bypass the RDP logon screen; Empire can swap sethc.exe/utilman.exe/Magnify.exe remotely via WMI.
Sources
- Event Triggered Execution: Accessibility Features — MITRE ATT&CK T1546.008
- Event Triggered Execution: Image File Execution Options Injection — MITRE ATT&CK T1546.012
Related
- setakeownership-privilege — the privilege that makes the file replacement possible for non-admins
- icacls — DACL syntax used to grant write access
- windows-file-association-hijacking — sibling “redirect what the OS launches” persistence class (T1546.001)