https://github.com/zelon88/accessibility-tools-utilmon-defender

A Windows 7-10 startup script for detecting and preventing "Ease Of Access" attacks.
https://github.com/zelon88/accessibility-tools-utilmon-defender

accessibility admin-tools anti-hacking defender security

Last synced: 8 months ago
JSON representation

A Windows 7-10 startup script for detecting and preventing "Ease Of Access" attacks.

• Host: GitHub
• URL: https://github.com/zelon88/accessibility-tools-utilmon-defender
• Owner: zelon88
• License: gpl-3.0
• Created: 2018-09-01T03:52:30.000Z (almost 8 years ago)
• Default Branch: master
• Last Pushed: 2019-10-28T19:31:53.000Z (over 6 years ago)
• Last Synced: 2025-04-04T18:15:16.066Z (about 1 year ago)
• Topics: accessibility, admin-tools, anti-hacking, defender, security
• Language: Visual Basic
• Size: 16.6 KB
• Stars: 6
• Watchers: 3
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# Accessibility-Tools-utilmon-Defender

A Windows 7-10 startup script for detecting and preventing "Ease Of Access" attacks.

This script was featured in the [how-to](https://www.honestrepair.net/index.php/category/howto/) blog post "[Windows Accessibility Tools… For Hackers Too???](https://www.honestrepair.net/index.php/2018/08/26/windows-accessibility-tools-for-hackers-too/)" on the [HonestRepair Blog](https://www.honestrepair.net/index.php/blog-posts/).

It is intended to be added to Group Policy Management on a domain or the Local Group Policy Editor on a standalone PC as a machine startup script. 

The script hashes cmd.exe (if it exists) and compares it against the hashes for each vulnerable tool in the Ease of Access center (utilmon.exe). A hard-coded hash exists as a default if cmd.exe was moved. 

*You must download "[Fake Sendmail For Windows](https://www.glob.com.au/sendmail/)" and extract all files to wherever you install the Accessibility_Defender.vbs script.*

If a compromise is detected the script will create a logfile of the incident and shut down the machine.