Permission Check Via Accesschk.EXE

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2026•0•0•1

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges