Permission Check Via Accesschk.EXE
Detects the execution of Accesschk.exe, a Sysinternals utility used for auditing permissions. Adversaries often abuse this tool to discover privileges and access rights on a system, which can aid in privilege escalation or further discovery within the environment.
Sigma
