proc_creation_win_lolbin_pcwrun_follina

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability