Elastic Defend high stable eql

Execution via Program Compatibility Assistant

Identifies attempts to proxy execution using Microsoft Program Compatibility Assistant binary. Adversaries may use pcalua.exe to evade suspicious parent child process relationships.

View Source

Detection Logic

process where event.action == "start" and
 (
  (process.parent.name : "pcalua.exe" and process.parent.args : "-a" and not process.parent.args : "-d") or
  (process.name : "pcalua.exe" and process.args : "-a" and not process.args : "-d")
 ) and
 not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and

 /* excluding signed and non Microsoft binaries */
 not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*")

Field Validations

Loading…

Comments (0)

Loading comments...