Full pcalua->powershell->WmiPrvSE->cmd->rundll32 lineage chain

Seb Cantar@sebcantar

•updated Aug 27, 2026•11•0•5

This rule detects a specific and highly suspicious process lineage: pcalua.exe (Program Compatibility Assistant) spawning powershell.exe, which subsequently triggers WmiPrvSE.exe, followed by cmd.exe and finally rundll32.exe. This chain often indicates a sophisticated attempt to bypass security controls by nesting execution through legitimate Windows utilities.