huntrule

Windows: pcwrun.exe Indirect Command Execution via Path Traversal

Detects pcwrun.exe spawning with '../' in the command line, indicating potential indirect execution abuse.

FreeUnreviewedSigmahighv1
title: "Windows: pcwrun.exe Indirect Command Execution via Path Traversal"
id: 0fd819ba-dd2e-4457-b377-66c29671dd02
status: test
description: This rule flags process creation where the image ends with pcwrun.exe and the command line contains a '../' path traversal sequence. Attackers can abuse Program Compatibility Assistant tooling to indirectly trigger execution with attacker-controlled paths. The detection relies on Windows process creation telemetry, specifically the executable name and command-line content.
references:
  - https://twitter.com/nas_bench/status/1535663791362519040
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-13
tags:
  - attack.stealth
  - attack.t1218
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \pcwrun.exe
    CommandLine|contains: ../
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 6004abd0-afa4-4557-ba90-49d172e0a299
    type: derived

What it detects

This rule flags process creation where the image ends with pcwrun.exe and the command line contains a '../' path traversal sequence. Attackers can abuse Program Compatibility Assistant tooling to indirectly trigger execution with attacker-controlled paths. The detection relies on Windows process creation telemetry, specifically the executable name and command-line content.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.