Possible DLL Injection Through AccCheckConsole (via process_creation)

title: Possible DLL Injection Through AccCheckConsole (via process_creation)
id: 424abec0-cc54-593a-ba10-b5e249dbf1ab
status: stable
description: This rule detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application's UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool enables a user to provide a DLL that can contain a custom "verification routine". An adversary can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.
references:
    - https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340
    - https://twitter.com/bohops/status/1477717351017680899?s=12
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/
author: Huntrule Team
date: 2026-05-15
tags:
    - attack.execution
    - detection.threat-hunting
    - attack.defense-evasion
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\AccCheckConsole.exe'
        - OriginalFileName: 'AccCheckConsole.exe'
    selection_cli:
        CommandLine|contains:
            - ' -hwnd'
            - ' -process '
            - ' -window '
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium