Impact

The successful abuse of PsSuspend can lead to significant operational disruption and security breaches. By suspending essential processes, attackers can disable endpoint detection and response (EDR) agents, anti-virus software, and other security controls, allowing them to operate undetected. It can also be used to pause critical business applications, leading to denial of service, data inconsistencies, or creating windows of opportunity for data exfiltration before legitimate processes can react. The impact could range from temporary service outages to complete system compromise if security tools are effectively bypassed.

Recommendation

• Enable process creation logging (e.g., via Sysmon) on all Windows endpoints to ensure the process_creation log source is available.
• Deploy the "Sysinternals PsSuspend Execution" Sigma rule to your SIEM for detecting PsSuspend usage.
• Monitor for process suspensions that are not part of approved administrative tasks.
• Implement application whitelisting or strict controls over the execution of Sysinternals tools on sensitive systems.

Attack Chain

1. Initial Compromise: An attacker gains initial access to a target Windows system, typically through methods like phishing, exploiting a vulnerable service, or compromising credentials.
2. Tool Staging: The Accesschk.exe utility (or its 64-bit variants like accesschk64.exe) is transferred to the compromised system, often via existing C2 channels, PowerShell, or embedded within a larger malicious payload.
3. Permission Discovery: The attacker executes Accesschk.exe from a command prompt or script using specific flags such as uwcqv (users with write access to services), kwsu (kernel objects, services, users), or uwdqs (users with write access to directories/shares) to enumerate detailed permissions across various system objects.
4. Output Analysis: The command output is parsed by the attacker to identify specific misconfigurations or weak access control lists (ACLs) that could be exploited. This might include writable service binaries, DLL hijack paths, or modifiable registry keys.
5. Identify Escalation Paths: Based on the gathered permission data, the attacker pinpoints viable privilege escalation vectors, such as services configured to run with SYSTEM privileges but having a writable binary path, or registry keys that control critical system functions and are modifiable by low-privileged users.
6. Exploitation Planning: The attacker formulates a strategy to exploit the identified weaknesses, which could involve replacing legitimate binaries with malicious ones, modifying service parameters, or injecting code into processes to achieve higher privileges.
7. Privilege Escalation: The attacker executes their chosen method to elevate privileges, often resulting in gaining administrator or SYSTEM-level access on the compromised host.
8. Post-Escalation Actions: With elevated privileges, the attacker can proceed with further malicious activities, including deploying additional malware, establishing persistence, moving laterally within the network, or exfiltrating sensitive data.

Impact

Successful abuse of Accesschk.exe as part of a privilege escalation chain can lead to full system compromise, allowing attackers to gain complete control over the affected Windows machine. This enables them to bypass security controls, install rootkits, steal credentials, deploy ransomware, or exfiltrate critical intellectual property and sensitive data. While Accesschk.exe itself doesn't cause direct damage, its role in uncovering vulnerabilities can directly lead to significant security breaches, financial loss, reputational damage, and operational disruption for affected organizations across all sectors.

Recommendation

• Deploy the Sigma rule Permission Check Via Accesschk.EXE to your SIEM and tune for your environment to detect suspicious usage of this utility.
• Ensure Sysmon process creation logging is enabled for all Windows endpoints to capture Image and CommandLine details necessary for the rule Permission Check Via Accesschk.EXE.
• Regularly audit permissions on critical system resources and services to identify and remediate misconfigurations that Accesschk.exe could reveal to an attacker.