Windows: AccCheckConsole execution with injection-capable command-line parameters

Alerts on AccCheckConsole.exe executions whose CLI parameters align with loading custom verification logic via a DLL.

FreeUnreviewedSigmamediumv1

windows-acccheckconsole-execution-with-injection-capable-command-line-parameters-0f6da907

title: "Windows: AccCheckConsole execution with injection-capable command-line parameters"
id: aec2b0e7-a3fe-46f8-af7e-a2b2241ea8fa
status: test
description: This rule flags process creation events where AccCheckConsole.exe is executed with command-line arguments consistent with specifying the target window/process and invoking the tool’s configurable verification behavior. Attackers can leverage this capability by supplying a custom DLL containing a verification routine that would be loaded in the AccCheckConsole context. The detection relies on Windows process creation telemetry, matching the executable identity (Image path or OriginalFileName) and required command-line substrings.
references:
  - https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340
  - https://twitter.com/bohops/status/1477717351017680899?s=12
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_acccheckconsole_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-06
modified: 2024-08-29
tags:
  - attack.execution
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \AccCheckConsole.exe
    - OriginalFileName: AccCheckConsole.exe
  selection_cli:
    CommandLine|contains:
      - " -hwnd"
      - " -process "
      - " -window "
  condition: all of selection_*
falsepositives:
  - Legitimate use of the UI Accessibility Checker
level: medium
license: DRL-1.1
related:
  - id: 0f6da907-5854-4be6-859a-e9958747b0aa
    type: derived

What it detects

This rule flags process creation events where AccCheckConsole.exe is executed with command-line arguments consistent with specifying the target window/process and invoking the tool’s configurable verification behavior. Attackers can leverage this capability by supplying a custom DLL containing a verification routine that would be loaded in the AccCheckConsole context. The detection relies on Windows process creation telemetry, matching the executable identity (Image path or OriginalFileName) and required command-line substrings.

Known false positives

Legitimate use of the UI Accessibility Checker

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.