Library / LOLBin
pcalua.exe
Program Compatibility Assistant · Microsoft Corporation
OriginalFilename
None. No observed build carries an OriginalFilename, so sensors log -.
No OriginalFilenameSigma rules use a value no build carries
Gotchas
pcalua.exe (pcalua -a <file> proxy execution) has an OriginalFilename key whose value is empty, and an empty InternalName. Sensors log no value, so detections need the image path and command line.
- No OriginalFilename in any observed build, so Sysmon logs
-and OriginalFileName rules can't match it. Anchor on the image path, hash or signer instead. - 2 SigmaHQ rules match
OriginalFileName: pcalua.exe, but no observed build carries an OriginalFilename: those rule arms never fire.
Query snippets
# No OriginalFilename in any observed build: match on the image instead
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\pcalua.exe'
condition: selectionprocess_creation logsource. Sigma string matching is case-insensitive.
| tstats summariesonly=false count from datamodel=Endpoint.Processes
where Processes.process_name="pcalua.exe"
by Processes.dest Processes.process_name Processes.process_path Processes.process
| rename Processes.* as *Endpoint.Processes data model. On raw Sysmon events the field is OriginalFileName.
DeviceProcessEvents
| where FileName =~ "pcalua.exe"Microsoft Defender XDR advanced hunting. in~ and =~ are case-insensitive.
process where event.type == "start" and process.name : "pcalua.exe"ECS process.pe.original_file_name is a keyword field: in~ is case-insensitive, Kibana KQL is not.
String(Image || '').toLowerCase().endsWith("\\pcalua.exe")Filter expression (JavaScript) for events carrying Sysmon's OriginalFileName field.
Values across builds
| OriginalFilename | Builds | Arch | File version | Windows releases | Source | Sysmon |
|---|---|---|---|---|---|---|
| none | 11 | x64 | 10.0.10240.21161 → 10.0.28000.3231 | Win10 1507 → Win11 26H1 (12) | Host scan, Winbindex | ✓ 1 |
All 11 parsed builds · 9 Windows release groups not verifiable
| SHA256 | Version | Arch | OriginalFilename | Windows releases | Signature | Source | Sysmon |
|---|---|---|---|---|---|---|---|
| c22feda76575… | 10.0.28000.3231 | x64 | none | Win11 26H1 | Winbindex | ||
| c343cd38a408… | 10.0.26100.9711 | x64 | none | Win11 24H2 | Unsigned | Host scan, Winbindex | ✓ |
| 6f9f114ae511… | 10.0.19041.7802 | x64 | none | Win10 21H2 | Unsigned | Winbindex | |
| 553781b2aec9… | 10.0.17763.9376 | x64 | none | Win10 1809 | Unsigned | Winbindex | |
| 08393cd18bdf… | 10.0.14393.9612 | x64 | none | Win10 1607 | Unsigned | Winbindex | |
| 18343e1fdf69… | 10.0.10240.21161 | x64 | none | Win10 1507 | Unsigned | Winbindex | |
| d1ac86027579… | 10.0.26100.5074 | x64 | none | Win11 24H2, Win11 25H2 | Unsigned | Winbindex | |
| 8c3f1db11ddb… | 10.0.19041.906 | x64 | none | Win10 2004, Win10 21H1 | Signed (Catalog file) | Winbindex | |
| 2799fff1b6c9… | 10.0.17134.1 | x64 | none | Win10 1803 | Unsigned | Winbindex | |
| 8813cc507f70… | 10.0.18362.449 | x64 | none | Win10 1903 | Unsigned | Winbindex | |
| 4eedcf856149… | 10.0.10586.1540 | x64 | none | Win10 1511 | Unsigned | Winbindex |
Winbindex builds link to the Microsoft symbol server copy that was hashed and parsed.