Indirect Command Execution By Program Compatibility Wizard

Title: Indirect Command Execution By Program Compatibility Wizard
Status: test
Description:Detect indirect command execution via Program Compatibility Assistant pcwrun.exe
References:
  -https://twitter.com/pabraeken/status/991335019833708544
  -https://lolbas-project.github.io/lolbas/Binaries/Pcwrun/
Author: A. Sungurov , oscd.community
Date: 2020-10-12
modified:2021-11-27
Tags:

• -'attack.stealth'
• -'attack.t1218'
• -'attack.execution'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\pcwrun.exe'
  condition:selection
Falsepositives:
  -Need to use extra processing with 'unique_count' / 'filter' to focus on outliers as opposed to commonly seen artifacts
  -Legit usage of scripts
Level: low