Investigation: Pcalua/Forfiles Indirect Command Execution

1. Confirm the alert

   Detects indirect command execution via the Program Compatibility Assistant (pcalua.exe -a) launching a program, or forfiles.exe using its /c switch to spawn cmd. Both are LOLBins (T1202) used to break the parent-child chain and launch payloads without a direct process lineage to the interpreter. The rule matched on logsource `process_creation`. Verify the event genuinely matches the described behavior, and not a known legitimate case. The rule matches on these fields — examine the exact value in the event:

   • **CommandLine** contains: ` -a `, `/c`, `cmd`
   • **Image** contains: `\pcalua.exe`, `\forfiles.exe`

2. Pivot: find the origin and context

   Investigation queries (read-only):

   • Parent of the triggering process (full execution chain)
   • Other processes spawned by the same parent within 10 minutes
   • Is the binary signed? unusual path (%TEMP%, %APPDATA%, user directory)?

3. Rule out false positives

   Known benign causes for this rule:

   • Admin scripts using forfiles for date-based file cleanup that shell out to cmd; scope by the target command in /c.

4. Context (threat intelligence)

   The rule's references — CTI context to qualify the incident:

   • https://attack.mitre.org/techniques/T1202/