Permission Check Via Accesschk.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

Known false positives

System administrator Usage

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1069.001` Permission Groups Discovery: Local Groups

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Permission Check Via Accesschk.EXE
id: c625d754-6a3d-4f65-9c9a-536aea960d37
status: test
description: Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43
    - https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW
    - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
    - https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat
author: Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems)
date: 2020-10-13
modified: 2026-06-29
tags:
    - attack.discovery
    - attack.t1069.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Product|endswith: 'AccessChk'
        - Description|contains: 'Reports effective permissions'
        - Image|endswith:
              - '\accesschk.exe'
              - '\accesschk64.exe'
              - '\accesschk64a.exe'
        - OriginalFileName: 'accesschk.exe'
    selection_cli:
        CommandLine|contains: # These are the most common flags used with this tool. You could add other combinations if needed
            - 'uwcqv '
            - 'kwsu '
            - 'qwsu '
            - 'uwdqs '
    condition: all of selection*
falsepositives:
    - System administrator Usage
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection*

Stage 1: `selection_img`

selection_img:
    - Product|endswith: 'AccessChk'
    - Description|contains: 'Reports effective permissions'
    - Image|endswith:
          - '\accesschk.exe'
          - '\accesschk64.exe'
          - '\accesschk64a.exe'
    - OriginalFileName: 'accesschk.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains:
        - 'uwcqv '
        - 'kwsu '
        - 'qwsu '
        - 'uwdqs '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`kwsu` `qwsu` `uwcqv` `uwdqs`	`field:"CommandLine" kind:match`
`Description`	match	`Reports effective permissions`	`field:"Description" kind:match value:"Reports effective permissions"`
`Image`	ends_with	`\accesschk.exe` corpus 3 (sigma 3) `\accesschk64.exe` corpus 2 (sigma 2) `\accesschk64a.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`accesschk.exe`	`field:"OriginalFileName" kind:eq value:"accesschk.exe"`
`Product`	ends_with	`AccessChk`	`field:"Product" kind:ends_with value:"AccessChk"`