LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

AccCheckConsole.exe

View source

Verifies UI accessibility requirements

ExecuteAWL Bypass
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute1

EXAMPLE 01T1218

Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

COMMAND
AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}
USE CASE
Local execution of managed code from assembly DLL.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · DLL (.NET)

AWL Bypass1

EXAMPLE 01T1218

Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

COMMAND
AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}
USE CASE
Local execution of managed code to bypass AppLocker.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · DLL (.NET)
02 / ON DISK

Known paths

C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x86\AccChecker\AccCheckConsole.exe
C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x64\AccChecker\AccCheckConsole.exe
C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\arm\AccChecker\AccCheckConsole.exe
C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\arm64\AccChecker\AccCheckConsole.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    Sysmon Event ID 1 - Process Creation

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Jimmy@bohops