Uncommon Pcalua Process Execution

Rule Info

Name
Uncommon Pcalua Process Execution
Author
X__Junior
Description
Detects uncommon process tree execution of pcalua
Reference
https://www.huntress.com/blog/the-hunt-for-redcurl-2
Date
2025-01-08 00:00:00
Modified
None
Id
ad17d781-3525-4449-94de-e5baaf811148
Tags
attack.execution attack.t1204
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022