Pcalua.exe

Commands

1. ExecuteUser T1202

   Proxy execution of binary

   pcalua.exe -a {PATH:.exe}

   Open the target .EXE using the Program Compatibility Assistant.

   os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   Execute: EXE

2. ExecuteUser T1202

   Proxy execution of remote dll file

   pcalua.exe -a {PATH_SMB:.dll}

   Open the target .DLL file with the Program Compatibilty Assistant.

   os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10

   Execute: DLLExecute: Remote

3. ExecuteUser T1202

   Execution of CPL files

   pcalua.exe -a {PATH_ABSOLUTE:.cpl} -c Java

   Open the target .CPL file with the Program Compatibility Assistant.

   os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   Execute: DLL

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml

Resources

• https://twitter.com/KyleHanslovan/status/912659279806640128