{"id":"c625d754-6a3d-4f65-9c9a-536aea960d37","title":"Permission Check Via Accesschk.EXE","description":"Detects the usage of the \"Accesschk\" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges","author":"Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2020-10-13","modified":"2023-02-20","tags":["attack.discovery","attack.t1069.001"],"technique_ids":["T1069.001"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["System administrator Usage"],"references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43","https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW","https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat","https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat"],"source_path":"rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml","source_sha256":"a5b43691601ee59f5bd02143377bf4e872e4425a4a3d81b1bf6569e18cc931c7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Permission Check Via Accesschk.EXE\nid: c625d754-6a3d-4f65-9c9a-536aea960d37\nstatus: test\ndescription: Detects the usage of the \"Accesschk\" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges\nreferences:\n    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43\n    - https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW\n    - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat\n    - https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat\nauthor: Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems)\ndate: 2020-10-13\nmodified: 2023-02-20\ntags:\n    - attack.discovery\n    - attack.t1069.001\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_img:\n        - Product|endswith: 'AccessChk'\n        - Description|contains: 'Reports effective permissions'\n        - Image|endswith:\n              - '\\accesschk.exe'\n              - '\\accesschk64.exe'\n        - OriginalFileName: 'accesschk.exe'\n    selection_cli:\n        CommandLine|contains: # These are the most common flags used with this tool. You could add other combinations if needed\n            - 'uwcqv '\n            - 'kwsu '\n            - 'qwsu '\n            - 'uwdqs '\n    condition: all of selection*\nfalsepositives:\n    - System administrator Usage\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1069.001","id":"T1069.001","name":"Local Groups","page":"techniques/enterprise/T1069.001/"}],"data_path":"data/detection-rules/c625d754-6a3d-4f65-9c9a-536aea960d37.json","kind":"sigma"}