Execution via Program Compatibility Assistant

[rule]
description = """
Identifies attempts to proxy execution using Microsoft Program Compatibility Assistant binary. Adversaries may use
pcalua.exe to evade suspicious parent child process relationships.
"""
id = "812a9a02-aac3-43b9-873a-70c2882fe19b"
license = "Elastic License v2"
name = "Execution via Program Compatibility Assistant"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Pcalua/"]
version = "1.0.8"

query = '''
process where event.action == "start" and
 (
  (process.parent.name : "pcalua.exe" and process.parent.args : "-a" and not process.parent.args : "-d") or
  (process.name : "pcalua.exe" and process.args : "-a" and not process.args : "-d")
 ) and
 not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and

 /* excluding signed and non Microsoft binaries */
 not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*")
'''

min_endpoint_version = "7.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"