Windows: Pcalua.exe Flag -a Command Execution

Flags Pcalua.exe executions containing " -a" that may indicate indirect command execution on Windows.

FreeUnreviewedSigmamediumv1

windows-pcalua-exe-flag-a-command-execution-0955e4e1

title: "Windows: Pcalua.exe Flag -a Command Execution"
id: a993f35d-7ea6-4af6-b7c4-4f4669e9ed0d
related:
  - id: fa47597e-90e9-41cd-ab72-c3b74cfb0d02
    type: obsolete
  - id: 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
    type: derived
status: test
description: This rule identifies process creation where the executed binary is Pcalua.exe and the command line contains the flag " -a". Pcalua can facilitate indirect command execution, which attackers may use to run arbitrary commands while attempting to evade application controls. The detection relies on Windows process creation telemetry, matching the executable path and a characteristic command-line substring.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
  - https://pentestlab.blog/2020/07/06/indirect-command-execution/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml
author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule Team
date: 2022-06-14
modified: 2023-01-04
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \pcalua.exe
    CommandLine|contains: " -a"
  condition: selection
falsepositives:
  - Legitimate use by a via a batch script or by an administrator.
level: medium
license: DRL-1.1

What it detects

This rule identifies process creation where the executed binary is Pcalua.exe and the command line contains the flag " -a". Pcalua can facilitate indirect command execution, which attackers may use to run arbitrary commands while attempting to evade application controls. The detection relies on Windows process creation telemetry, matching the executable path and a characteristic command-line substring.

Known false positives

Legitimate use by a via a batch script or by an administrator.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.