Sigma rule: Permission Check Via Accesschk.EXE

Rule

Title

Permission Check Via Accesschk.EXE

Status

test

Level

medium

Author

Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Date

2020-10-13

Modified

2026-06-29

File

rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Product|endswith: 'AccessChk'
    - Description|contains: 'Reports effective permissions'
    - Image|endswith:
          - '\accesschk.exe'
          - '\accesschk64.exe'
          - '\accesschk64a.exe'
    - OriginalFileName: 'accesschk.exe'
selection_cli:
    CommandLine|contains: # These are the most common flags used with this tool. You could add other combinations if needed
        - 'uwcqv '
        - 'kwsu '
        - 'qwsu '
        - 'uwdqs '
condition: all of selection*

False positives (as the rule lists them)

• System administrator Usage

Tags

• attack.discovery
• attack.t1069.001

MITRE ATT&CK ids this rule names

• T1069.001

References

• https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43
• https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW
• https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
• https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml