In this clip,
I will talk about a specific example of how OSSEC can detect
the manipulation of a Microsoft Windows accessibility feature
to bypass authentication systems.
The MITRE ATT&CK framework lists Event Triggered Execution as the parent
technique and has a sub technique named Accessibility Features. On a Microsoft
Windows system, accessibility features make using technology much more
accessible (pun intended) for those with disabilities.
For example, the screen magnifier or sticky keys are both accessibility features.
We should be familiar with the Create Account guidance
from MITRE SHIELD, which I covered in a previous clip
regarding active defense measures.
The MITRE SHIELD guidance for accessibility features
is mapped to the parent technique,
Event Triggered Execution, and it suggests having a
reliable baseline that you check regularly,
preferably using an automation.
The idea is that if an adversary modifies system accessibility files,
you already have a process that rolls back the system to a known good state.
There is a bonus here in that any monitored file will benefit,
and not just the accessibility related files.
OSSEC has a feature called syscheck,
I have a portion of the syscheck configuration on the screen.
This default configuration tells syscheck to perform the file
integrity monitoring scan on a 12‑hour frequency, which is the
default configured in seconds.
There's also a list of locations we want to be scanned. In the upcoming demo,
I will be focusing on the sticky keys accessibility file.
See you then.