Windows Process Creation: accesschk.exe Permission Audit Execution
Flags AccessChk (accesschk.exe) permission/audit executions using common query flags in Windows process creation logs.
- Product
- windows
- Category
- process_creation
- Author
- Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-10-13
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of the Sysinternals AccessChk utility by matching process image paths and file metadata, along with a description indicating it reports effective permissions. It further narrows matches to common AccessChk command-line usage patterns that are typically used to query user or group access rights. Such permission-audit activity is important because it can help an attacker validate privileges and plan subsequent actions. The detection relies on Windows process creation telemetry, including Image path, OriginalFileName, Description, and CommandLine.
Reporting behind it
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43
- youtube.comhttps://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW
- github.comhttps://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
- github.comhttps://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: accesschk.exe Permission Audit Execution"
id: bf3bf2de-32b7-46ec-b652-25a379563dda
status: test
description: This rule identifies execution of the Sysinternals AccessChk utility by matching process image paths and file metadata, along with a description indicating it reports effective permissions. It further narrows matches to common AccessChk command-line usage patterns that are typically used to query user or group access rights. Such permission-audit activity is important because it can help an attacker validate privileges and plan subsequent actions. The detection relies on Windows process creation telemetry, including Image path, OriginalFileName, Description, and CommandLine.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43
- https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW
- https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
- https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml
author: Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-10-13
modified: 2026-06-29
tags:
- attack.discovery
- attack.t1069.001
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Product|endswith: AccessChk
- Description|contains: Reports effective permissions
- Image|endswith:
- \accesschk.exe
- \accesschk64.exe
- \accesschk64a.exe
- OriginalFileName: accesschk.exe
selection_cli:
CommandLine|contains:
- "uwcqv "
- "kwsu "
- "qwsu "
- "uwdqs "
condition: all of selection*
falsepositives:
- System administrator Usage
level: medium
license: DRL-1.1
related:
- id: c625d754-6a3d-4f65-9c9a-536aea960d37
type: derived