Suspicious Pcalua.exe Proxy Execution
Detects the execution of pcalua.exe proxying mshta.exe, a known indirect command execution technique used in the initial access phase of EtherRAT via ClickFix to bypass command-line interpreter restrictions and execute remote HTA scripts.
Sigma
