Verifies UI accessibility requirements Located at: C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x86\AccChecker\AccCheckConsole.exe; C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x64\AccChecker\AccCheckConsole.exe; C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\arm\AccChecker\AccCheckConsole.exe.
acccheckconsoleacccheckconsoleSandbox: execFile · Timeout: 30s
security.execution.command security.defense-evasion.bypass Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name. (Local execution of managed code from assembly DLL.)
AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name. (Local execution of managed code to bypass AppLocker.)
AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_susp_acccheckconsole.yml |
| ioc | Sysmon Event ID 1 - Process Creation |
| other | https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340 |
acccheckconsole is a Windows LOLBin. Verifies UI accessibility requirements Located at: C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x86\AccChecker\AccCheckConsole.exe; C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x64\AccChecker\AccCheckConsole.exe; C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\arm\AccChecker\AccCheckConsole.exe.