LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

iscsicpl.exe

View source

Microsoft iSCSI Initiator Control Panel tool

UAC Bypass
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

UAC Bypass2

EXAMPLE 01T1548.002

c:\windows\syswow64\iscsicpl.exe has a DLL injection through `C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\ISCSIEXE.dll`, resulting in UAC bypass.

COMMAND
c:\windows\syswow64\iscsicpl.exe
USE CASE
Execute a custom DLL via a trusted high-integrity process without a UAC prompt.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · DLL
EXAMPLE 02T1548.002

Both `c:\windows\system32\iscsicpl.exe` and `c:\windows\system64\iscsicpl.exe` have UAC bypass through launching iscicpl.exe, then navigating into the Configuration tab, clicking Report, then launching your custom command.

COMMAND
iscsicpl.exe
USE CASE
Execute a binary or script as a high-integrity process without a UAC prompt.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMDApplication · GUI
02 / ON DISK

Known paths

c:\windows\system32\iscsicpl.exe
c:\windows\syswow64\iscsicpl.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\ISCSIEXE.dll

  • IOC

    Suspicious child process to iscsicpl.exe like cmd, powershell etc.

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

hacker.house
Ekitji@eki_erk