Code Execution via Pcwutl.dll

Title: Code Execution via Pcwutl.dll
Status: test
Description:Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.
References:
  -https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/
  -https://twitter.com/harr0ey/status/989617817849876488
Author: Julia Fomina, oscd.community
Date: 2020-10-05
modified:2023-02-09
Tags:

• -'attack.stealth'
• -'attack.t1218.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\rundll32.exe' OriginalFileName:'RUNDLL32.EXE'   selection_cli:
    CommandLine|contains|all:
      -'pcwutl'
      -'LaunchApplication'

  condition:all of selection_*
Falsepositives:
  -Use of Program Compatibility Troubleshooter Helper
Level: medium