Code Execution via Pcwutl.dll

calendar Feb 9, 2023 · attack.defense_evasion attack.t1218.011  ·
Share on: linkedin copy

Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

Sigma rule (View on GitHub)

 1title: Code Execution via Pcwutl.dll
 2id: 9386d78a-7207-4048-9c9f-a93a7c2d1c05
 3status: test
 4description: Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.
 5references:
 6    - https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/
 7    - https://twitter.com/harr0ey/status/989617817849876488
 8author: Julia Fomina, oscd.community
 9date: 2020/10/05
10modified: 2023/02/09
11tags:
12    - attack.defense_evasion
13    - attack.t1218.011
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection_img:
19        - Image|endswith: '\rundll32.exe'
20        - OriginalFileName: 'RUNDLL32.EXE'
21    selection_cli:
22        CommandLine|contains|all:
23            - 'pcwutl'
24            - 'LaunchApplication'
25    condition: all of selection_*
26falsepositives:
27    - Use of Program Compatibility Troubleshooter Helper
28level: medium

References

  • Pcwutl | LOLBAS

    Launch executable by calling the LaunchApplication function. rundll32.exe pcwutl.dll,LaunchApplication calc.exe Use caseLaunch an executable. Privileges requiredUser Operating systemsWindows 10, Wi...


    Read More

  • Something went wrong, but don’t fret — let’s give it another shot.


    Read More

Related rules

to-top