The Sticky Keys Backdoor: Auditing sethc.exe and utilman.exe Hijacks on Windows

Some backdoors are elegant. This one is not — and that is exactly why it survives. The "Sticky Keys backdoor" is a decades-old trick that turns a helpful Windows accessibility feature into a pre-authentication SYSTEM shell reachable from the lock screen. No malware to load, no service to install, no network beacon to catch. Just one binary swapped for another, and a machine that will hand out a command prompt to anyone standing in front of it.

How the hijack works

Windows ships a handful of accessibility helpers that the logon UI (LogonUI/Winlogon) will happily launch before anyone signs in, running as NT AUTHORITY\SYSTEM. The two most abused are:

• C:\Windows\System32\sethc.exe — Sticky Keys, triggered by pressing Shift five times.
• C:\Windows\System32\utilman.exe — Ease of Access / Utility Manager, triggered by Win+U.

The attack has two classic variants. The first simply overwrites the helper with a copy of cmd.exe:

copy /y C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe

The second — quieter, because it leaves the original binaries intact — uses the Image File Execution Options (IFEO) "Debugger" key so that launching the accessibility tool actually launches cmd:

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\cmd.exe" /f

Either way, an attacker at the lock screen — or connected over RDP, where the trigger works before authentication — presses Shift five times and gets a SYSTEM console. From there it is trivial to add a local admin, reset a password, or dump credentials.

The reason this technique refuses to die: it needs write access to System32 once, then it persists across reboots, survives password changes, and often survives reimaging if it is baked into a "golden" image. It is a favorite for physical-access engagements and for attackers who already have admin and want durable, low-noise re-entry.

Why it slips past defenses

This is a living-off-the-land technique end to end. The "malware" is a signed, Microsoft-authored binary (cmd.exe). There is no C2 traffic. Antivirus rarely flags a file copy inside System32, and the IFEO variant touches nothing but a registry value that legitimate debuggers also use. If your detection strategy is built around network alerts and signature scanning, the Sticky Keys backdoor is genuinely invisible.

What actually catches it is state auditing: comparing what should be true of a hardened endpoint against what is true right now.

How to audit for it

There are two reliable tells. First, the accessibility binaries should be their real selves — check the file hash or version info against a known-good copy. A quick integrity check:

Get-FileHash C:\Windows\System32\sethc.exe, C:\Windows\System32\utilman.exe -Algorithm SHA256
(Get-Item C:\Windows\System32\sethc.exe).VersionInfo | Select FileDescription, OriginalFilename

If sethc.exe reports an OriginalFilename of Cmd.Exe, you have found a live backdoor. Second, scan IFEO for any accessibility tool carrying a Debugger value:

Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" |
  Where-Object { $_.PSChildName -in 'sethc.exe','utilman.exe','osk.exe','magnify.exe','narrator.exe','displayswitch.exe','atbroker.exe' } |
  ForEach-Object { Get-ItemProperty $_.PSPath -Name Debugger -EA SilentlyContinue }

Don't forget the less-famous helpers — osk.exe (on-screen keyboard), Magnify.exe, Narrator.exe, DisplaySwitch.exe, and AtBroker.exe are all launchable from the logon screen and all fair game.

Hardening beyond detection

• Enable NLA (Network Level Authentication) for RDP so credentials are required before the remote session — and its lock-screen triggers — ever load.
• Track file-integrity on the System32 accessibility set so any swap raises a finding immediately.
• Alert on new Debugger values under IFEO; there is almost never a legitimate reason for one to appear on a workstation.
• Restrict physical and console access; this attack assumes someone can reach the lock screen.

Where WinSentinel fits

WinSentinel treats the accessibility-tool integrity check and the IFEO Debugger sweep as first-class audit findings, not a script you have to remember to run. On a single machine, the free WinSentinel agent audits sethc.exe, utilman.exe, and the rest of the accessibility set for tampering, flags any IFEO debugger hijack, and folds the result into your overall security score — full power, no limits, every module included.

Across an organization, Pro takes the same per-machine finding and turns it into fleet intelligence: a central node rolls up which of your 50 or 500 endpoints have a hijacked accessibility binary, alerts you when a previously-clean machine drifts into a tampered state, and lets you dispatch the fix. A physical-access backdoor planted on one laptop in a branch office stops being a needle in a haystack and becomes a single red row on a dashboard.

The Sticky Keys backdoor is old, dumb, and still working in 2026 because most defenses are looking for something more sophisticated. Audit for it, integrity-check the accessibility binaries, and it goes from an invisible re-entry point to a one-line finding you fix in minutes.