iscsicpl.exe

Commands

1. UAC BypassUser T1548.002

   Execute a custom DLL via a trusted high-integrity process without a UAC prompt.

   c:\windows\syswow64\iscsicpl.exe

   c:\windows\syswow64\iscsicpl.exe has a DLL injection through C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\ISCSIEXE.dll, resulting in UAC bypass.

   os: Windows 10, Windows 11

   Execute: DLL

2. UAC BypassUser T1548.002

   Execute a binary or script as a high-integrity process without a UAC prompt.

   iscsicpl.exe

   Both c:\windows\system32\iscsicpl.exe and c:\windows\system64\iscsicpl.exe have UAC bypass through launching iscicpl.exe, then navigating into the Configuration tab, clicking Report, then launching your custom command.

   os: Windows 10, Windows 11

   Execute: CMDApplication: GUI

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_uac_bypass_iscsicpl.yml
• IOCC:\Users\<username>\AppData\Local\Microsoft\WindowsApps\ISCSIEXE.dll
• IOCSuspicious child process to iscsicpl.exe like cmd, powershell etc.

Resources

• https://learn.microsoft.com/en-us/windows-server/storage/iscsi/iscsi-initiator-portal
• https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC