iscsicpl.exe

Microsoft iSCSI Initiator Configuration Tool file version info (xCyclopedia)

LOLBAS UAC Bypass 1 ATT&CK technique 2 documented commands 12 known copies with hashes

How iscsicpl.exe is abused

documented by LOLBAS

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for iscsicpl.exe.

2 documented commands

from LOLBAS, each read by the identifier

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control User privileges

c:\windows\syswow64\iscsicpl.exe has a DLL injection through C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\ISCSIEXE.dll, resulting in UAC bypass.

c:\windows\syswow64\iscsicpl.exe

Identify

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control User privileges

Both c:\windows\system32\iscsicpl.exe and c:\windows\system64\iscsicpl.exe have UAC bypass through launching iscicpl.exe, then navigating into the Configuration tab, clicking Report, then launching your custom command.

iscsicpl.exe

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for iscsicpl.exe, by Ekitji, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for iscsicpl.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

Is it the real iscsicpl.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft iSCSI Initiator Configuration Tool

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\iscsicpl.exe · signed by Microsoft Windows

06ab4a4355f88c818ac1f764809326f8c9ad9fe1b0d69024837d91170023059f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\iscsicpl.exe · signed by Microsoft Windows

cafd9d904d11663e2cb1815b3cdf99998f649c5fd7610e367c9cd31ea23d5170

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\iscsicpl.exe · signed by Microsoft Windows

4138f8fee342c54723a38d2f07f56f3e482926f72b078a937492a94d45571f78

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\iscsicpl.exe · signed by Microsoft Windows

e5e2f1673d1da42b134c35d74655cbeb7272686d52f65b5fb3c1fe2b2f75586e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\iscsicpl.exe · signed by Microsoft Windows

5ba25830e3af7ebcb288940e549ca86ca08e09ce953db69de71cbfa689142989

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\iscsicpl.exe · signed by Microsoft Windows

77a6f696058c0181bcc4392b821c80391ccab203f37e8f143b228c588bfbac7b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\iscsicpl.exe · signed by Microsoft Windows

f3a8986adb353e75fdfca44a0c1dc6796ddbfbdeb936f2482c5386f6f7a27df7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\iscsicpl.exe · signed by Microsoft Windows

feb783c81b0bc6a5e7bedf3e1eb71106c95b2b818272b841902f14f33b507dd5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\iscsicpl.exe · signed by Microsoft Windows

59505ccfdcb36882dd053b15f4df2212e73090a3c6ec333e5c1c3a17ba79b8e5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\iscsicpl.exe · signed by Microsoft Windows

f172d2f71eb88fd70f1bdbf2f2bfeffd8c09ba03daee8a182c47ae77db1a4dda

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\iscsicpl.exe · not signed

843a1f6f9d85e1db0176aae39bbc3c26853b9840d4194f4be6259dad0b8e1c60

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\iscsicpl.exe · not signed

9bcb7a05b9a1752b9fcd7be69eb6d4683341828a28f95f5acadf9a37392af4d9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.