acccheckconsole.exe

LOLBAS Execute, AWL Bypass 1 Sigma rule name it 1 ATT&CK technique 2 documented commands 4 known copies with hashes

How acccheckconsole.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-window

AWL Bypass T1218 System Binary Proxy Execution

-window

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for acccheckconsole.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}

Identify

Trips 1 Sigma rule: mediumPotential DLL Injection Via AccCheckConsole by Florian Roth (Nextron Systems)

AWL Bypass T1218 System Binary Proxy Execution User privileges

Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}

Identify

Trips 1 Sigma rule: mediumPotential DLL Injection Via AccCheckConsole by Florian Roth (Nextron Systems)

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for acccheckconsole.exe, by bohops, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for acccheckconsole.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumPotential DLL Injection Via AccCheckConsoleFlorian Roth (Nextron Systems)

T1218System Binary Proxy Execution

Is it the real acccheckconsole.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\AccChecker\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\AccChecker\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\AccChecker\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft (R) Windows (R) Operating System, Microsoft Corporation

4 known copies

10.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\AccChecker\AccCheckConsole.exe · signed by Microsoft Windows Kits Publisher

60ffbecb6301a6ea0cc380d558dba4ca07e8360a3a838ea317061b6be6da6f4f

10.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\AccChecker\AccCheckConsole.exe · signed by Microsoft Corporation

9ec5d88096c84d9bf533433d38daa31ee61e34bd8fe9c5ed7ecd60fddefb6792

10.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\AccChecker\AccCheckConsole.exe · signed by Microsoft Corporation

b7aeb85ce2b87d3dbb46d6bf86dd304e13c96ae6db98059bdcd94afa0ebe2809

10.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\AccChecker\AccCheckConsole.exe · signed by Microsoft Windows Kits Publisher

d70d8281ef0f03342f3c0d4e680907b98a86292709fec0b23fdab34aa84d43c2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.