atbroker.exe

Windows Assistive Technology Manager file version info (xCyclopedia)

LOLBAS Execute 2 Sigma rules name it 1 ATT&CK technique 1 documented command 14 known copies with hashes

How atbroker.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-start

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for atbroker.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Start a registered Assistive Technology (AT).

ATBroker.exe /start malware

Identify

Trips 1 Sigma rule: mediumUncommon Assistive Technology Applications Execution Via AtBroker.EXE by Mateusz Wydra, oscd.community

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for atbroker.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for atbroker.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumUncommon Assistive Technology Applications Execution Via AtBroker.EXEMateusz Wydra, oscd.community

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

T1218System Binary Proxy Execution

Is it the real atbroker.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Assistive Technology Manager

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\AtBroker.exe · signed by Microsoft Windows

020736ca188d1c9e9b4eefc274951550aa3c926918ef1038566d5eb4c6649dc8

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\AtBroker.exe · signed by Microsoft Windows

a6546a9741994a1f557c649b70b892d088680be45d82a56e73946e5292201da7

10.0.19041.1023 (WinBuild.160101.0800) · C:\Windows\system32\AtBroker.exe · signed by Microsoft Windows

ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd

10.0.19041.1023 (WinBuild.160101.0800) · C:\Windows\SysWOW64\AtBroker.exe · signed by Microsoft Windows

e54bce96572f17b4dad28689a5c4fcb55042830bf167ffa91005b0748d11c0b5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\AtBroker.exe · signed by Microsoft Windows

4d75d895625dcf95e06db50816cec9ef125b25ff916af3f9cea68cdbd2630799

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\AtBroker.exe · signed by Microsoft Windows

cdc2b0207769f3f73bbf068eff68661d145909b410f2c25fbfa5a38d4aad464c

10.0.18362.449 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\AtBroker.exe · signed by Microsoft Windows

7b0f4d776a38238147b1f79daeaf21047b0dcabe212bef8bfe92f5ffe9a88de2

10.0.18362.449 (WinBuild.160101.0800) · C:\WINDOWS\system32\AtBroker.exe · signed by Microsoft Windows

a4924c3a207b8f1c55318b0012d0e99d06cdeef8709296ce25881cc46b31aec1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\AtBroker.exe · signed by Microsoft Windows

22b2a930d97c30bf53b7bc9838f8c4c938d7d0f806eae3601f9a01aeac803443

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\AtBroker.exe · signed by Microsoft Windows

6837e1c70823796eb24d9e5e0209bea5c857a34f70b936d6d1cf5791c4f74961

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\AtBroker.exe · signed by Microsoft Windows

9e71607479cf64e9c343bd525f3f241fb10bb53e500c1f76ba538d3ef6139b46

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\AtBroker.exe · signed by Microsoft Windows

a84417ee9d039891af43b267896db921a40838d8a17cc1be29785d031e5944d4

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\AtBroker.exe · not signed

63a92b2a5c99f4c339bc55ba45b61d0cd6a4e4970b6ba9613b7b0e19771e4cd1

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\AtBroker.exe · not signed

94755d0c49ec3238ba3c74054efe54d4843caeb913a58efc1b696063fe107116

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.