Execute Pcwrun.EXE To Leverage Follina

Title: Execute Pcwrun.EXE To Leverage Follina
Status: test
Description:Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability
References:
  -https://twitter.com/nas_bench/status/1535663791362519040
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-13
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218'
• -'attack.execution'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\pcwrun.exe'
    CommandLine|contains: '../'
  condition:selection
Falsepositives:
  -Unlikely
Level: high