LoFP / need to use extra processing with 'unique_count' / 'filter' to focus on outliers as opposed to commonly seen artifacts

Techniques

• t1218

Sample rules

Indirect Command Execution By Program Compatibility Wizard

• source: sigma
• technicques:
  • t1218

Description

Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

Detection logic

condition: selection
selection:
  ParentImage|endswith: \pcwrun.exe