From ffc768e2621608c337b1e41c8ba0a806fc7fc14e Mon Sep 17 00:00:00 2001
From: Yuliya Fomina <yfomina@ptsecurity.com>
Date: Mon, 5 Oct 2020 11:30:24 +0300
Subject: [PATCH] Create win_susp_pcwutl.yml

---
 .../process_creation/win_susp_pcwutl.yml      | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 rules/windows/process_creation/win_susp_pcwutl.yml

diff --git a/rules/windows/process_creation/win_susp_pcwutl.yml b/rules/windows/process_creation/win_susp_pcwutl.yml
new file mode 100644
index 00000000..c3e62534
--- /dev/null
+++ b/rules/windows/process_creation/win_susp_pcwutl.yml
@@ -0,0 +1,27 @@
+title: Code execution via Pcwutl.dll
+id: 9386d78a-7207-4048-9c9f-a93a7c2d1c05
+description: Detects launch of executable by calling the LaunchApplication function pcwutl.dll.
+status: experimental
+references:
+    - https://github.com/api0cradle/LOLBAS/blob/master/OSLibraries/Pcwutl.md
+    - https://twitter.com/harr0ey/status/989617817849876488
+author: Julia Fomina
+date: 2020/10/2505
+tags:
+    - attack.defense_evasion
+    - attack.t1218.011
+    - attack.execution      # an old one
+    - attack.t1218      # an old one
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        Image|endswith: '\rundll32.exe'
+        CommandLine|contains|all:
+            - 'pcwutl'
+            - 'LaunchApplication'
+    condition: selection
+level: medium
+falsepositives:
+    - Use of Program Compatibility Troubleshooter Helper