Windows Process Creation: Suspicious RunAs-Like Command-Line Flag Combination

title: "Windows Process Creation: Suspicious RunAs-Like Command-Line Flag Combination"
id: adc730cb-a991-4bfd-8f77-864505fb9827
status: test
description: This rule flags Windows process creation events whose command line simultaneously contains user-setting flags (e.g., specifying system or administrator) and command-execution flags (e.g., cmd, powershell, whoami, wscript, cscript). Such flag combinations are commonly used by legitimate admin utilities but can also indicate attempts to impersonate or execute commands under a different target user. It relies on process creation telemetry and string matches against the CommandLine field for the relevant flag patterns.
references:
  - https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_privilege_escalation_cli_patterns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-11-11
tags:
  - attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_user:
    CommandLine|contains:
      - " -u system "
      - " --user system "
      - " -u NT"
      - ' -u "NT'
      - " -u 'NT"
      - " --system "
      - " -u administrator "
  selection_command:
    CommandLine|contains:
      - " -c cmd"
      - ' -c "cmd'
      - " -c powershell"
      - ' -c "powershell'
      - " --command cmd"
      - " --command powershell"
      - " -c whoami"
      - " -c wscript"
      - " -c cscript"
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 50d66fb0-03f8-4da0-8add-84e77d12a020
    type: derived