Sticky Keys

Description

A technique used in numerous ransomware attacks is a Sticky Keys hijack for privilege escalation/persistence. Surface realted alerts with this query.

Query · kql

// Checks for possible hijacking of Sticky Keys feature 
AlertInfo | where Title == "Sticky Keys binary hijack detected"
Raw source Sticky Keys · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 3c82774a-df78-44eb-9ab3-13ef37c63ae4
name: Sticky Keys
description: |
  A technique used in numerous ransomware attacks is a Sticky Keys hijack for privilege escalation/persistence. Surface realted alerts with this query.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
tactics:
- Ransomware
query: |
  // Checks for possible hijacking of Sticky Keys feature 
  AlertInfo | where Title == "Sticky Keys binary hijack detected"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.