.. /AccCheckConsole.exe
Star

Execute (DLL)
AWL bypass (DLL)

Verifies UI accessibility requirements

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

    AccCheckConsole.exe -window "Untitled - Notepad" C:\path\to\your\lolbas.dll
    Use case
    Local execution of managed code from assembly DLL.
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1218
    Tags
    Execute: DLL
    This LOLBAS executes Dynamic-Link Libraries (DLLs).

AWL bypass

  1. Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

    AccCheckConsole.exe -window "Untitled - Notepad" C:\path\to\your\lolbas.dll
    Use case
    Local execution of managed code to bypass AppLocker.
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1218
    Tags
    Execute: DLL
    This LOLBAS executes Dynamic-Link Libraries (DLLs).