Indirect Command Execution By Program Compatibility Wizard

calendar Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.execution  ·
Share on: linkedin copy

Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

Sigma rule (View on GitHub)

 1title: Indirect Command Execution By Program Compatibility Wizard
 2id: b97cd4b1-30b8-4a9d-bd72-6293928d52bc
 3status: test
 4description: Detect indirect command execution via Program Compatibility Assistant pcwrun.exe
 5references:
 6    - https://twitter.com/pabraeken/status/991335019833708544
 7    - https://lolbas-project.github.io/lolbas/Binaries/Pcwrun/
 8author: A. Sungurov , oscd.community
 9date: 2020-10-12
10modified: 2021-11-27
11tags:
12    - attack.defense-evasion
13    - attack.t1218
14    - attack.execution
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection:
20        ParentImage|endswith: '\pcwrun.exe'
21    condition: selection
22fields:
23    - ComputerName
24    - User
25    - ParentCommandLine
26    - CommandLine
27falsepositives:
28    - Need to use extra processing with 'unique_count' / 'filter' to focus on outliers as opposed to commonly seen artifacts
29    - Legit usage of scripts
30level: low

References

Related rules

to-top