Use of Pcalua for Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•18

Detects execution of commands and binaries from the context of the Program Compatibility Assistant (Pcalua.exe). This can be used as a Living Off The Land Binary (LOLBIN) to bypass application whitelisting.