iscsicpl.exe

Microsoft iSCSI Initiator Control Panel tool

UAC Bypass

Execute a custom DLL via a trusted high-integrity process without a UAC prompt.

c:\windows\syswow64\iscsicpl.exe

c:\windows\syswow64\iscsicpl.exe has a DLL injection through `C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\ISCSIEXE.dll`, resulting in UAC bypass. — MITRE: T1548.002 — Privileges: User

Execute a binary or script as a high-integrity process without a UAC prompt.

iscsicpl.exe

Both `c:\windows\system32\iscsicpl.exe` and `c:\windows\system64\iscsicpl.exe` have UAC bypass through launching iscicpl.exe, then navigating into the Configuration tab, clicking Report, then launching your custom command. — MITRE: T1548.002 — Privileges: User