Potential DLL Injection via AccCheckConsole.exe Command-Line Parameters on Windows
Alerts on AccCheckConsole.exe executions whose CLI parameters align with loading custom verification logic via a DLL.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-06
- Updated
- 2026-07-31
What it detects
This rule flags execution of AccCheckConsole.exe with command-line arguments that include the window handle switch, a target process identifier, and a window selector. AccCheckConsole supports providing a custom verification routine via a DLL, which could be supplied by an attacker and loaded under the tool’s execution context. The detection relies on Windows process creation telemetry, matching the executable identity and specific command-line fragments.
Reporting behind it
- gist.github.comhttps://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340
- twitter.comhttps://twitter.com/bohops/status/1477717351017680899?s=12
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_acccheckconsole_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-acccheckconsole-execution-with-injection-capable-command-line-parameters-0f6da907
title: Potential DLL Injection via AccCheckConsole.exe Command-Line Parameters on Windows
id: aec2b0e7-a3fe-46f8-af7e-a2b2241ea8fa
status: test
description: This rule flags execution of AccCheckConsole.exe with command-line arguments that include the window handle switch, a target process identifier, and a window selector. AccCheckConsole supports providing a custom verification routine via a DLL, which could be supplied by an attacker and loaded under the tool’s execution context. The detection relies on Windows process creation telemetry, matching the executable identity and specific command-line fragments.
references:
- https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340
- https://twitter.com/bohops/status/1477717351017680899?s=12
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_acccheckconsole_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-06
modified: 2024-08-29
tags:
- attack.execution
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \AccCheckConsole.exe
- OriginalFileName: AccCheckConsole.exe
selection_cli:
CommandLine|contains:
- " -hwnd"
- " -process "
- " -window "
condition: all of selection_*
falsepositives:
- Legitimate use of the UI Accessibility Checker
level: medium
license: DRL-1.1
related:
- id: 0f6da907-5854-4be6-859a-e9958747b0aa
type: derived