Playing With Old Hacks

This blog-style report demonstrates how an attacker with physical access can boot from Windows installation media and replace or symlink accessibility/logon binaries (utilman.exe, sethc.exe, narrator.exe, magnify.exe, osk.exe) to execute commands at the logon screen. The author tests multiple replacement binaries, documents Windows Defender signature Win32/AccessibilityEscalation.A blocking some replacements, shows that alternatives like ftp.exe and a third-party cmd can bypass signatures, and concludes that full-disk encryption is the primary mitigation.