Legacy "Sticky Keys" exploit remains a persistent threat vector for attackers with physical device access
A critical Windows accessibility feature designed to assist users with disabilities continues to serve as a reliable attack vector for cybercriminals and nation-state actors seeking to bypass login screens and escalate privileges on targeted systems, according to recent security research and threat intelligence reports.
The Sticky Keys exploit, which leverages the Windows accessibility program sethc.exe
activated by pressing the Shift key five times consecutively, has been
actively exploited by attackers for over two decades—from Windows XP
through the latest Windows 11 installations. Despite Microsoft's ongoing
security improvements, this technique remains valid on the latest
version of Windows 11.
Recent Exploitation Activity
Security researchers have documented multiple instances of Sticky Keys exploitation in 2025, including its use by Chinese nation-state actors. The MITRE ATT&CK framework classifies this technique under T1546.008, noting that adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.
Microsoft security researchers have observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting vulnerabilities targeting internet-facing SharePoint servers, while also leveraging traditional accessibility exploits as part of broader attack campaigns.
In corporate environments, security teams report detecting attempted Sticky Keys binary hijacking attacks against end-user laptops. Microsoft's AccessibilityEscalation trojan detection system identifies when accessibility utilities are being changed to attempt password resets, though this typically represents attacks from inside the system rather than network-based intrusions.
Technical Implementation and Impact
The exploit functions by replacing the legitimate sethc.exe binary with cmd.exe
or another malicious executable. When attackers replace the Sticky Keys
executable file with the command prompt executable, pressing Shift five
times at the login screen launches a command prompt with SYSTEM-level
privileges.
Research published in July 2022 by Cyberis demonstrates that this technique requires physical access to a device with limited configuration hardening and the ability to boot it into Windows Recovery Environment (WinRE) or access the operating system disk in an unencrypted format.
The attack's persistence stems from its exploitation of legitimate system functionality. Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed.
Enterprise Security Implications
The vulnerability poses significant risks to enterprise environments, particularly those with inadequate physical security controls. The Sticky Keys exploit poses several significant risks to systems, including unauthorized access allowing attackers to bypass login credentials, data theft or loss with administrative privileges, and malware installation compromising system security and integrity.
Recent threat intelligence indicates the exploit's continued relevance in modern attack campaigns. A May 2025 security analysis revealed that Microsoft considers physical access exploits outside their threat model, stating that issues requiring physical access are not considered security vulnerabilities unless they allow direct code execution bypassing the logon screen.
Modern Mitigation Strategies
Security experts recommend multiple layers of protection against accessibility-based attacks. BitLocker's full operating system disk encryption with recovery keys that are only accessible to key personnel or administrators provides the most comprehensive solution.
Organizations should implement several protective measures including disabling the Sticky Keys activation shortcut through Windows settings, using full disk encryption like BitLocker, setting BIOS passwords to restrict unauthorized access to system settings, and maintaining regular system updates.
Endpoint Detection and Response (EDR) solutions provide additional protection layers. Microsoft Defender for Endpoint and similar EDR tooling can detect Sticky Keys attacks and stop malicious activity, though if an attacker successfully replaces sethc.exe, they have likely already modified the disk and potentially disabled other controls.
Broader Context: Windows Accessibility Security
The Sticky Keys exploit represents part of a broader pattern of accessibility feature abuse in modern operating systems. In January 2025, Cyberis discovered a local privilege escalation vulnerability (CVE-2025-27582) in One Identity Secure Password Extension that similarly exploits accessibility features available on the Windows lock screen.
Security researchers note that this attack vector highlights fundamental tensions between accessibility and security. One security researcher observed in May 2025 that "Windows has many hidden doors—some are there for accessibility, others unintentionally enable powerful bypasses".
Current Threat Landscape
While Microsoft addressed 111 vulnerabilities in its August 2025 Patch Tuesday release, including 13 rated critical and 91 rated as important, elevation of privilege vulnerabilities accounted for 39.3% of the vulnerabilities patched, the Sticky Keys exploit persists due to its reliance on legitimate system functionality rather than traditional software vulnerabilities.
CISA's threat intelligence documentation confirms that adversaries continue to leverage accessibility features, noting that "the sethc.exe program is often referred to as 'sticky keys', and has been used by adversaries for unauthenticated access through a remote desktop login screen".
The persistence of this decades-old technique underscores the ongoing challenges security teams face in balancing accessibility requirements with robust security controls, particularly in environments where physical device access cannot be comprehensively controlled.
Beyond Sticky Keys: The Broader Accessibility Attack Surface
The Sticky Keys exploit represents just one component of a comprehensive attack surface targeting Windows accessibility features. Security researchers have documented similar vulnerabilities affecting multiple accessibility programs that can be triggered from the login screen, creating what the MITRE ATT&CK framework categorizes as "Event Triggered Execution: Accessibility Features" (T1546.008).
Additional Vulnerable Accessibility Programs
Beyond the well-known sethc.exe
(Sticky Keys), attackers can exploit several other accessibility
binaries using identical replacement or registry modification
techniques:
- Utility Manager (
utilman.exe): Activated by Windows+U key combination, manages accessibility options - On-Screen Keyboard (
osk.exe): Virtual keyboard accessible via touch interfaces and accessibility menu - Magnifier (
Magnify.exe): Screen magnification tool for visually impaired users - Narrator (
Narrator.exe): Screen reader that announces text and interface elements - Display Switcher (
DisplaySwitch.exe): Manages multiple monitor configurations - App Switcher (
AtBroker.exe): Assistive Technology broker for application switching
Research published in May 2025
demonstrates that these accessibility features follow identical
exploitation patterns, with attackers replacing legitimate binaries with
cmd.exe or configuring Image File Execution Options (IFEO) registry entries to launch malicious debuggers.
Registry-Based Attack Methods
Modern accessibility exploits increasingly rely on registry manipulation rather than file replacement, using the Image File Execution Options mechanism. This approach configures malicious "debuggers" for accessibility programs without replacing the original binaries, making detection more challenging.
The registry-based method involves creating entries under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[program].exe
With a "Debugger" value pointing to cmd.exe
or other malicious executables. This technique bypasses Windows File
Protection (WFP) and Windows Resource Protection (WRP) mechanisms that
protect system files in newer Windows versions.
Microsoft's Detection and Mitigation Responses
Microsoft has implemented several defensive measures to counter accessibility-based attacks, though their effectiveness varies across different Windows versions and security configurations.
Windows Defender Detection: Since September 2018, Windows Defender includes signatures for Win32/AccessibilityEscalation that detect when accessibility programs have been hijacked through IFEO registry modifications. The detection automatically removes malicious debugger entries and restores normal functionality.
Security researchers report that Windows Defender monitors the following accessibility programs for suspicious debugger configurations:
- Display Switcher (
DisplaySwitch.exe) - On-Screen Keyboard (
osk.exe) - Magnifier (
Magnify.exe) - Narrator (
Narrator.exe) - Sticky Keys (
sethc.exe) - Utility Manager (
utilman.exe)
System File Protection: Modern Windows versions implement enhanced code signing requirements and system file protection. In newer Windows versions, replaced binaries must be digitally signed for x64 systems, reside in the system directory, and remain protected by Windows File or Resource Protection mechanisms.
Real-Time Monitoring:
Enterprise security solutions can monitor for file integrity changes
and registry modifications affecting accessibility programs. Windows
System File Checker (sfc.exe)
can detect unauthorized modifications to system binaries, though it
cannot identify permission-based attacks or registry modifications.
Limitations of Current Defenses
Despite Microsoft's defensive improvements, significant gaps remain in accessibility exploit prevention. Windows Defender detection can be bypassed in Safe Mode, where the antivirus service starts with reduced functionality, providing attackers with approximately 30 seconds to complete modifications before detection activates.
The registry-based IFEO method remains effective even with file protection mechanisms enabled, as it doesn't require modifying protected system files. Additionally, permission-based attacks that modify file ACLs (Access Control Lists) to grant write access to accessibility binaries often evade traditional detection mechanisms.
Recent security research indicates that while direct binary replacement triggers Windows Defender alerts, subtle permission modifications and alternative debugger configurations may still succeed on fully patched systems with endpoint protection enabled.
Enterprise Implications and Advanced Mitigations
Organizations face heightened risks from accessibility-based attacks due to their legitimate business requirements for accessibility compliance and remote access capabilities. The techniques work effectively against Remote Desktop Protocol (RDP) connections, expanding the attack surface beyond physical access scenarios.
Advanced Protection Strategies include implementing application allowlisting through Windows Defender Application Control or AppLocker to prevent unauthorized executable launches, deploying Host-based Intrusion Prevention Systems (HIPS) that monitor registry modifications and file integrity changes, and configuring audit policies to log accessibility feature usage and registry modifications.
Detection Capabilities should include monitoring for unusual accessibility program launches outside normal user sessions, tracking file modification timestamps for system accessibility binaries, and implementing behavioral analysis to identify abnormal command prompt launches from login screens.
Security teams report that comprehensive protection requires layered defenses combining disk encryption, endpoint detection and response (EDR) solutions, and physical security controls. Organizations must balance accessibility compliance requirements with security restrictions, often implementing separate accessibility workstations with enhanced monitoring rather than disabling features entirely.
SIDEBAR: Understanding the Sticky Keys Exploit
How the Attack Works
Step 1: Physical Access Required
- Attacker needs physical access to the target device
- Device must be powered off or restarted
- Works on all Windows versions from XP through Windows 11
Step 2: Boot into Recovery Environment
- Restart Windows while holding Shift key
- Select: Troubleshoot → Advanced Options → Command Prompt
- Access Windows Recovery Environment (WinRE)
Step 3: File Replacement
- Navigate to C:\Windows\System32\
- Backup original sethc.exe file
- Replace sethc.exe with cmd.exe (or malicious executable)
Step 4: Exploitation
- Restart into normal Windows
- At login screen, press Shift key 5 times
- Command prompt opens with SYSTEM privileges
- Create new administrator account or reset passwords
Consumer Protection Measures
Essential Safeguards:
🔒 Enable Full Disk Encryption
- Windows: Enable BitLocker on all drives
- How: Settings → Update & Security → Device Encryption
- Why: Even with physical access, encrypted drives remain protected
- Key Management: Store recovery keys securely, separate from device
🚫 Disable Sticky Keys Shortcut
- Path: Settings → Ease of Access → Keyboard
- Action: Turn off "Use Sticky Keys" shortcut
- Impact: Prevents Shift-key activation without affecting accessibility
🔐 Set BIOS/UEFI Password
- Access: Press F2/F12/Delete during boot (varies by manufacturer)
- Function: Prevents unauthorized boot device changes
- Backup: Document password in secure location
📱 Physical Security Best Practices
- Never leave devices unattended in public spaces
- Use cable locks for desktop computers
- Enable automatic screen locks (maximum 15 minutes)
- Consider laptop tracking software
🛡️ Additional Security Layers
- Windows Defender: Ensure real-time protection enabled
- User Account Control (UAC): Keep at default or higher
- Windows Updates: Enable automatic installation
- Secure Boot: Verify enabled in UEFI settings
Detection and Response
Warning Signs:
- Unexpected administrative accounts
- Modified system files (sethc.exe timestamp changes)
- Unusual login attempts or system behavior
- EDR alerts for accessibility file modifications
If Compromised:
- Immediately disconnect from network
- Boot from external antivirus rescue disk
- Check for unauthorized user accounts
- Restore sethc.exe from backup
- Change all passwords after verification
- Consider complete system reimaging
Enterprise Considerations:
- Deploy endpoint detection and response (EDR) solutions
- Implement device compliance policies
- Regular security awareness training
- Physical security assessments for workstations
Sources
- Twingate. (2025). "What Is The Sticky Keys Exploit? How It Works & Examples." https://www.twingate.com/blog/glossary/sticky%20keys%20exploit
- MITRE Corporation. (2025). "Event Triggered Execution: Accessibility Features, Sub-technique T1546.008." ATT&CK Enterprise Framework. https://attack.mitre.org/techniques/T1546/008/
- Payne, B. (2025). "Ethical hacking: How to conduct a Sticky Keys hack." TechTarget SearchSecurity. https://www.techtarget.com/searchsecurity/feature/Ethical-hacking-How-to-conduct-a-Sticky-Keys-hack
- Microsoft. (2025). "Need help determining the root cause of a Security Incident M365 Defender." Microsoft Q&A Community. https://learn.microsoft.com/en-us/answers/questions/918335/need-help-determining-the-root-cause-of-a-security
- Cyberis Limited. (2022). "Sticky Keys - classic EUD device privilege escalation." https://www.cyberis.com/article/sticky-keys-classic-eud-device-privilege-escalation
- Salas, E. (2024). "Exploiting Sticky Keys via Sethc.exe for Privilege Escalation on Windows." Medium. https://medium.com/@enyel.salas84/exploiting-sticky-keys-via-sethc-exe-for-privilege-escalation-on-windows-03a15f2fd560
- Alert Logic. (2025). "Windows Sticky Keys/Utilman Registry cmd.exe Backdoor." Alert Logic Support Center. https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor
- Data Luthier. (2025). "The Sticky Keys Hack: BitLocker Unlocked in Seconds." https://dataluthier.com/2025/05/21/the-sticky-keys-hack/
- Narang, S. (2025). "Microsoft's August 2025 Patch Tuesday Addresses 107 CVEs." Tenable. https://www.tenable.com/blog/microsofts-august-2025-patch-tuesday-addresses-107-cves-cve-2025-53779
- Cybersecurity and Infrastructure Security Agency. (2025). "Event Triggered Execution: Accessibility Features." CISA Eviction Strategies Tool. https://www.cisa.gov/eviction-strategies-tool/info-attack/T1015
- Microsoft Security. (2025). "Disrupting active exploitation of on-premises SharePoint vulnerabilities." Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
