Accessibility Features Backdoor - System32 Binary Replacement

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects modifications or renames to critical Windows accessibility feature binaries (sethc.exe, utilman.exe, osk.exe, magnify.exe) located in System32. Adversaries frequently replace these binaries with malicious counterparts or command shells to achieve persistence and gain SYSTEM-level execution via accessibility shortcuts at the logon screen.