Suspicious RunAs-Like Flag Combination (via process_creation)

title: Suspicious RunAs-Like Flag Combination (via process_creation)
id: 68396908-12de-51c9-bee3-da984d302e34
status: stable
description: This rule detects anomalous command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools
references:
    - https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html
author: Huntrule Team
date: 2026-05-17
tags:
    - attack.privilege-escalation
    - attack.t1134
logsource:
    category: process_creation
    product: windows
detection:
    selection_user:
        CommandLine|contains:
            - ' -u system '
            - ' --user system '
            - ' -u NT'
            - ' -u "NT'
            - " -u 'NT"
            - ' --system '
            - ' -u administrator '
    selection_command:
        CommandLine|contains:
            - ' -c cmd'
            - ' -c "cmd'
            - ' -c powershell'
            - ' -c "powershell'
            - ' --command cmd'
            - ' --command powershell'
            - ' -c whoami'
            - ' -c wscript'
            - ' -c cscript'
    condition: all of selection*
falsepositives:
    - Unknown
level: medium