Permission Check Via Accesschk.EXE

Title: Permission Check Via Accesschk.EXE
Status: test
Description:Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43
  -https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW
  -https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
  -https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat
Author: Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-10-13
modified:2026-06-29
Tags:

• -'attack.discovery'
• -'attack.t1069.001'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
Product|endswith:'AccessChk' Description|contains:'Reports effective permissions'     - Image|endswith:
      - '\accesschk.exe'
      - '\accesschk64.exe'
      - '\accesschk64a.exe'
OriginalFileName:'accesschk.exe'   selection_cli:
    CommandLine|contains:
      -'uwcqv '
      -'kwsu '
      -'qwsu '
      -'uwdqs '

  condition:all of selection*
Falsepositives:
  -System administrator Usage
Level: medium