Helper binary for Assistive Technology (AT) Located at: C:\Windows\System32\Atbroker.exe; C:\Windows\SysWOW64\Atbroker.exe.
atbrokeratbrokerSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Start a registered Assistive Technology (AT). (Executes code defined in registry for a new AT. Modifications must be made to the system registry to either register or modify an existing Assistive Technology (AT) service entry.)
ATBroker.exe /start malware| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_susp_atbroker.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml |
| ioc | Changes to HKCU\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration |
| ioc | Changes to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs |
| ioc | Unknown AT starting C:\Windows\System32\ATBroker.exe /start malware |
atbroker is a Windows LOLBin. Helper binary for Assistive Technology (AT) Located at: C:\Windows\System32\Atbroker.exe; C:\Windows\SysWOW64\Atbroker.exe.