Windows: AdvancedRun executed with RunAs IDs under high-privilege service accounts
Detects AdvancedRun execution where /RunAs is set to specific high-privilege IDs in the process command line.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-20
- Updated
- 2026-07-30
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where the command line indicates AdvancedRun usage along with specific /RunAs argument values (8, 4, 10, 11). Attackers and malware commonly use tools that can run under trusted or privileged contexts to increase stealth and effectiveness. The detection relies on Windows process creation telemetry, matching command-line substrings that include the AdvancedRun parameters and the targeted RunAs values.
Reporting behind it
- twitter.comhttps://twitter.com/splinter_code/status/1483815103279603714
- medium.comhttps://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
- elastic.cohttps://www.elastic.co/security-labs/operation-bleeding-bear
- winhelponline.comhttps://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: AdvancedRun executed with RunAs IDs under high-privilege service accounts"
id: f0360f99-3fb0-450a-8575-a80c705ff2a6
related:
- id: d2b749ee-4225-417e-b20e-a8d2193cbb84
type: similar
- id: fa00b701-44c6-4679-994d-5a18afa8a707
type: derived
status: test
description: This rule flags process creation where the command line indicates AdvancedRun usage along with specific /RunAs argument values (8, 4, 10, 11). Attackers and malware commonly use tools that can run under trusted or privileged contexts to increase stealth and effectiveness. The detection relies on Windows process creation telemetry, matching command-line substrings that include the AdvancedRun parameters and the targeted RunAs values.
references:
- https://twitter.com/splinter_code/status/1483815103279603714
- https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
- https://www.elastic.co/security-labs/operation-bleeding-bear
- https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-20
modified: 2023-02-21
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1134.002
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains:
- /EXEFilename
- /CommandLine
selection_runas:
- CommandLine|contains:
- " /RunAs 8 "
- " /RunAs 4 "
- " /RunAs 10 "
- " /RunAs 11 "
- CommandLine|endswith:
- /RunAs 8
- /RunAs 4
- /RunAs 10
- /RunAs 11
condition: all of selection*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user/info.yml
license: DRL-1.1