Does pcalua.exe interact with junctions?

Feb 13, 2025 ... ... exe. The "action" for the task is as follows: Action: Start a Program; Details: C:\Windows\system32\pcalua.exe -a rundll32 -c shell32.dll ... Apr 18, 2018 ... For example, Forfiles, the Program Compatibility Assistant ( pcalua.exe ), components of the Windows Subsystem for Linux (WSL), Scriptrunner.exe ... ... exe","IEExec.exe","InstallUtil.exe","javaw.exe",. "Microsoft.Workflow.Compiler.exe","msdt.exe","MSHTA.EXE","msiexec.exe","Msxsl.exe",. "odbcconf.exe","pcalua. May 20, 2022 ... Hence, the query is built to hunt for renamed process execution eg; cmd.exe renamed to xyz.exe and then executed. ... Pcalua.exe","Pcwrun.exe"," ... Mar 16, 2023 ... Description. The scenario executes the following command: powershell.exe forfiles /p c:\windows\system32 /m notepad.exe /c $pwd ... Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant ( pcalua. Feb 19, 2025 ... This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process information. While ... Oct 16, 2020 ... pcalua.exe -a C:\tmp\metasploit.exe. SyncAppvPublishingServer. The ... process “explore.exe” instead of “cmd.exe“. Copy explorer.exe C ... Aug 17, 2022 ... The process “pcalua.exe” is related to Program Compatibility Assistant. According to Microsoft: The Program Compatibility Assistant detects known compatibility ... May 4, 2020 ... Implementations. LolBAS Rare Commands (Pseudocode, CAR native). Pseudocode version of the below Splunk query. processes = search Process: ...