huntrule

Windows: Execution of Pcalua.exe with -a Argument

Flags Pcalua.exe executions containing " -a" that may indicate indirect command execution on Windows.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community (SigmaHQ), DRL 1.1
Published
2022-06-14
Updated
2026-07-31
AnalysisDetection
title: "Windows: Execution of Pcalua.exe with -a Argument"
id: a993f35d-7ea6-4af6-b7c4-4f4669e9ed0d
related:
  - id: fa47597e-90e9-41cd-ab72-c3b74cfb0d02
    type: obsolete
  - id: 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
    type: derived
status: test
description: This rule flags process creation where Image ends with \pcalua.exe and the CommandLine contains the substring " -a". Attackers can use Pcalua.exe to invoke indirect command execution behavior, which may help bypass application allowlisting controls. Detection relies on Windows process creation telemetry including the executable path and full command line.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
  - https://pentestlab.blog/2020/07/06/indirect-command-execution/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml
author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule Team
date: 2022-06-14
modified: 2023-01-04
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \pcalua.exe
    CommandLine|contains: " -a"
  condition: selection
falsepositives:
  - Legitimate use by a via a batch script or by an administrator.
level: medium
license: DRL-1.1