Indirect command execution using the Program Compatibility Assistant

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Indirect Command Execution (T1202)
Severity	Medium

Description

Pcalua.exe (Program Compatibility Assistant) is used for running old programs that have compatibility issues. Attackers can use pcalua.exe to indirectly execute their malicious programs.

Attacker's Goals

Evading detection by indirectly executing their malicious programs.

Investigative actions

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.