Techniques
Sample rules
Indirect Command Execution By Program Compatibility Wizard
- source: sigma
- technicques:
- t1218
Description
Detect indirect command execution via Program Compatibility Assistant pcwrun.exe
Detection logic
condition: selection
selection:
ParentImage|endswith: \pcwrun.exe