DEF CON 34 'Plug & Pwn': Wacom WTabletServiceISD 'PowerT' Debug Backdoor -- SYSTEM Shell

Ankit Mehta@Secvyn

•updated Aug 9, 2026•0•0•8

This rule detects potential privilege escalation through the abuse of a debug backdoor in the Wacom WTabletServiceISD service. It identifies when the 'PowerT' registry value is set for the service, followed shortly by the service spawning a command shell (cmd.exe or powershell.exe) under SYSTEM privileges. It specifically excludes scenarios where AutoAdminLogon is enabled, which might otherwise trigger false positives.