aol.pm

Accessibility Features

Subtechnique · ATTACK:enterprise:T1546.008

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1546.008",
  "title": "Accessibility Features",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1546/008",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--70e52b04-2a0c-4cea-9d18-7149f1df9dc5",
  "external_id": "T1546.008",
  "domain": "enterprise",
  "created": "2020-01-24T14:32:40.315Z",
  "modified": "2025-10-24T17:48:56.964Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "privilege-escalation",
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "Narrator Accessibility Abuse",
      "url": "https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html"
    },
    {
      "source_name": "FireEye Hikit Rootkit",
      "url": "https://web.archive.org/web/20190216180458/https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html"
    },
    {
      "source_name": "DEFCON2016 Sticky Keys",
      "url": "https://www.slideshare.net/DennisMaldonado5/sticky-keys-to-the-kingdom"
    },
    {
      "source_name": "Tilbury 2014",
      "url": "https://web.archive.org/web/20200730053039/https://www.crowdstrike.com/blog/registry-analysis-with-crowdresponse/"
    }
  ]
}

Explicit source assertions (11)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47899da0-29da-4518-b94a-0f08bc01e5c9

Github PowerShell Empire

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--728c2a84-ac7d-4b17-a287-4c692d717065

FireEye APT41 Aug 2019

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a92197a8-ec5c-4366-92af-f45078a3bfd7

aptsim

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab069468-3dff-4c77-9293-adb0b2627a4e

RSA Shell Crew

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9f4c6ef-d0bd-4651-9445-4705e1fd85f2

Novetta-Axiom

ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7e86d53-378b-4cb5-8d86-2b7b5f4c1232

TechNet RDP Gateway

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc458462-2c4e-443c-977a-805ea1d6e5a8

TechNet RDP NLA

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ccec5b80-e16a-4379-926f-08c1c821497a

Beechey 2010 · Corio 2008 · Microsoft Windows Defender Application Control · TechNet Applocker vs SRP · NSA MS AppLocker · Windows Commands JPCERT

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df898edd-0829-4222-b50b-e7cbf75a0fb4

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:T1546.008 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e525352e-0d7e-41e4-bb35-9c50f9ef39c6

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e65112dc-8a58-486f-9f3b-5a84925a3e53

FireEye APT29 Domain Fronting · Mandiant No Easy Breach

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.