Windows Process Creation: accesschk.exe Permission Audit Execution

Flags AccessChk (accesschk.exe) permission/audit executions using common query flags in Windows process creation logs.

FreeUnreviewedSigmamediumv1

windows-process-creation-accesschk-exe-permission-audit-execution-c625d754

title: "Windows Process Creation: accesschk.exe Permission Audit Execution"
id: bf3bf2de-32b7-46ec-b652-25a379563dda
status: test
description: This rule identifies execution of the Sysinternals AccessChk utility by matching process image paths and file metadata, along with a description indicating it reports effective permissions. It further narrows matches to common AccessChk command-line usage patterns that are typically used to query user or group access rights. Such permission-audit activity is important because it can help an attacker validate privileges and plan subsequent actions. The detection relies on Windows process creation telemetry, including Image path, OriginalFileName, Description, and CommandLine.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43
  - https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW
  - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
  - https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml
author: Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-10-13
modified: 2026-06-29
tags:
  - attack.discovery
  - attack.t1069.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Product|endswith: AccessChk
    - Description|contains: Reports effective permissions
    - Image|endswith:
        - \accesschk.exe
        - \accesschk64.exe
        - \accesschk64a.exe
    - OriginalFileName: accesschk.exe
  selection_cli:
    CommandLine|contains:
      - "uwcqv "
      - "kwsu "
      - "qwsu "
      - "uwdqs "
  condition: all of selection*
falsepositives:
  - System administrator Usage
level: medium
license: DRL-1.1
related:
  - id: c625d754-6a3d-4f65-9c9a-536aea960d37
    type: derived

What it detects

This rule identifies execution of the Sysinternals AccessChk utility by matching process image paths and file metadata, along with a description indicating it reports effective permissions. It further narrows matches to common AccessChk command-line usage patterns that are typically used to query user or group access rights. Such permission-audit activity is important because it can help an attacker validate privileges and plan subsequent actions. The detection relies on Windows process creation telemetry, including Image path, OriginalFileName, Description, and CommandLine.

Known false positives

System administrator Usage

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.