From b385ef2ead5ccece5dbf1a2ec5ac35ee095d283e Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 10:15:26 -0700
Subject: [PATCH] Update windows_indirect_command_execution_via_pcalua.yml

Adding second reference for pcalua.exe
---
 .../endpoint/windows_indirect_command_execution_via_pcalua.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index d9246caf27..f9988b8b03 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter these results as needed.  
 references:
   - https://twitter.com/KyleHanslovan/status/912659279806640128
-  - REF2 - FIND ANOTHER REFERENCE
+  - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
 tags:
   analytic_story:
   - Living Off The Land