Microsoft iSCSI Initiator Control Panel tool Located at: c:\windows\system32\iscsicpl.exe; c:\windows\syswow64\iscsicpl.exe.
iscsicpliscsicplSandbox: execFile · Timeout: 30s
security.privilege-escalation.uac-bypass Outputs
process.output Command execution output
privilege_escalationprocess_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
c:\windows\syswow64\iscsicpl.exe has a DLL injection through `C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\ISCSIEXE.dll`, resulting in UAC bypass. (Execute a custom DLL via a trusted high-integrity process without a UAC prompt.)
c:\windows\syswow64\iscsicpl.exeBoth `c:\windows\system32\iscsicpl.exe` and `c:\windows\system64\iscsicpl.exe` have UAC bypass through launching iscicpl.exe, then navigating into the Configuration tab, clicking Report, then launching your custom command. (Execute a binary or script as a high-integrity process without a UAC prompt.)
iscsicpl.exe| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_uac_bypass_iscsicpl.yml |
| ioc | C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\ISCSIEXE.dll |
| ioc | Suspicious child process to iscsicpl.exe like cmd, powershell etc. |
iscsicpl is a Windows LOLBin. Microsoft iSCSI Initiator Control Panel tool Located at: c:\windows\system32\iscsicpl.exe; c:\windows\syswow64\iscsicpl.exe.