Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0005 ✕ technique: T1202 ✕

Show ATT&CK heatmap
  • Indirect command execution using the Program Compatibility Assistant Medium

    Pcalua.exe (Program Compatibility Assistant) is used for running old programs that have compatibility issues. Attackers can use pcalua.exe to indirectly execute their malicious programs.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indirect Command Execution (T1202)
    Required data: XDR Agent
    Attacker's goals: Evading detection by indirectly executing their malicious programs.
    Investigative actions: Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.