Windows

Pcalua.exePcalua.exe

Platform
Windows
Abuse functions
3
Mapped techniques
1

Description

Pcalua.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS / GTFOBins → MITRE crosswalk): T1218. Defenders should monitor execution of Pcalua.exe under non-administrative or sudo contexts and alert when its arguments match the abuse-function signatures.

Abuse functions· 3

ExecuteT1202

Proxy execution of binary

ExecuteT1202

Proxy execution of remote dll file

ExecuteT1202

Execution of CPL files

MITRE ATT&CK techniques· 1

T1202

Uses1

TypeTargetConfidenceTier
TechniqueIndirect Command Executiont1202100%live

Abuses1

TypeTargetConfidenceTier
TechniqueSystem Binary Proxy Executiont121885%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

LOLbin
Pcwrun.exe
LOLbin
Pnputil.exe
LOLbin
Pcwutl.dll
LOLbin
Rasautou.exe
LOLbin
Provlaunch.exe
LOLbin
wuauclt.exe
Sourced from LOLBAS Project. Curated by Adam Lundqvist, SQUR.