Indirect Command Execution By Program Compatibility Wizard (pcwrun.exe)
This rule detects indirect command execution by monitoring for processes where 'pcwrun.exe' is the parent process. 'pcwrun.exe' is part of the Program Compatibility Assistant and can be abused to proxy execution of other commands or binaries, a technique often used for defense evasion.
Sigma
