windows enabled community high v1.0.0

pcalua

Program Compatibility Assistant Located at: C:\Windows\System32\pcalua.exe.

📋 Live Preview 
pcalua
pcalua

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Open the target .EXE using the Program Compatibility Assistant. (Proxy execution of binary)

pcalua.exe -a {PATH:.exe}

Open the target .DLL file with the Program Compatibilty Assistant. (Proxy execution of remote dll file)

pcalua.exe -a {PATH_SMB:.dll}

Open the target .CPL file with the Program Compatibility Assistant. (Execution of CPL files)

pcalua.exe -a {PATH_ABSOLUTE:.cpl} -c Java

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml

Documentation

pcalua

pcalua is a Windows LOLBin. Program Compatibility Assistant Located at: C:\Windows\System32\pcalua.exe.

References