Windows Indirect Command Execution via pcwrun.exe (Program Compatibility Assistant)

title: Windows Indirect Command Execution via pcwrun.exe (Program Compatibility Assistant)
id: 79d12945-b711-4028-97f2-d5e262ba9d04
status: test
description: This rule flags process creation where the parent process is pcwrun.exe, which can be used to indirectly launch commands through Windows Program Compatibility Assistant behavior. Indirect execution helps attackers blend execution steps and reduce direct command-line visibility. It relies on process creation telemetry that includes the parent image path for each spawned process.
references:
  - https://twitter.com/pabraeken/status/991335019833708544
  - https://lolbas-project.github.io/lolbas/Binaries/Pcwrun/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun.yml
author: A. Sungurov , oscd.community, Huntrule Team
date: 2020-10-12
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1218
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \pcwrun.exe
  condition: selection
falsepositives:
  - Need to use extra processing with 'unique_count' / 'filter' to focus on outliers as opposed to commonly seen artifacts
  - Legit usage of scripts
level: low
license: DRL-1.1
related:
  - id: b97cd4b1-30b8-4a9d-bd72-6293928d52bc
    type: derived