huntrule

Windows: AdvancedRun executed with RunAs IDs under high-privilege service accounts

Detects AdvancedRun execution where /RunAs is set to specific high-privilege IDs in the process command line.

FreeUnreviewedSigmahighv1
title: "Windows: AdvancedRun executed with RunAs IDs under high-privilege service accounts"
id: f0360f99-3fb0-450a-8575-a80c705ff2a6
related:
  - id: d2b749ee-4225-417e-b20e-a8d2193cbb84
    type: similar
  - id: fa00b701-44c6-4679-994d-5a18afa8a707
    type: derived
status: test
description: This rule flags process creation where the command line indicates AdvancedRun usage along with specific /RunAs argument values (8, 4, 10, 11). Attackers and malware commonly use tools that can run under trusted or privileged contexts to increase stealth and effectiveness. The detection relies on Windows process creation telemetry, matching command-line substrings that include the AdvancedRun parameters and the targeted RunAs values.
references:
  - https://twitter.com/splinter_code/status/1483815103279603714
  - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
  - https://www.elastic.co/security-labs/operation-bleeding-bear
  - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-20
modified: 2023-02-21
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - /EXEFilename
      - /CommandLine
  selection_runas:
    - CommandLine|contains:
        - " /RunAs 8 "
        - " /RunAs 4 "
        - " /RunAs 10 "
        - " /RunAs 11 "
    - CommandLine|endswith:
        - /RunAs 8
        - /RunAs 4
        - /RunAs 10
        - /RunAs 11
  condition: all of selection*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user/info.yml
license: DRL-1.1

What it detects

This rule flags process creation where the command line indicates AdvancedRun usage along with specific /RunAs argument values (8, 4, 10, 11). Attackers and malware commonly use tools that can run under trusted or privileged contexts to increase stealth and effectiveness. The detection relies on Windows process creation telemetry, matching command-line substrings that include the AdvancedRun parameters and the targeted RunAs values.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.