windows enabled community high v1.0.0

pcwrun

Program Compatibility Wizard Located at: C:\Windows\System32\pcwrun.exe.

📋 Live Preview 
pcwrun
pcwrun

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Open the target .EXE file with the Program Compatibility Wizard. (Proxy execution of binary)

Pcwrun.exe {PATH_ABSOLUTE:.exe}

Leverage the MSDT follina vulnerability through Pcwrun to execute arbitrary commands and binaries. Note that this specific technique will not work on a patched system with the June 2022 Windows Security update. (Proxy execution of binary)

Pcwrun.exe /../../$(calc).exe

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/6199a703221a98ae6ad343c79c558da375203e4e/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml

Documentation

pcwrun

pcwrun is a Windows LOLBin. Program Compatibility Wizard Located at: C:\Windows\System32\pcwrun.exe.

References