Windows Process Creation: Suspicious RunAs-Like Command-Line Flag Combination
Flags Windows processes with both target-user and target-command flags in the same command line.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-11
- Updated
- 2026-07-30
What it detects
This rule flags Windows process creation events whose command line simultaneously contains user-setting flags (e.g., specifying system or administrator) and command-execution flags (e.g., cmd, powershell, whoami, wscript, cscript). Such flag combinations are commonly used by legitimate admin utilities but can also indicate attempts to impersonate or execute commands under a different target user. It relies on process creation telemetry and string matches against the CommandLine field for the relevant flag patterns.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Suspicious RunAs-Like Command-Line Flag Combination"
id: adc730cb-a991-4bfd-8f77-864505fb9827
status: test
description: This rule flags Windows process creation events whose command line simultaneously contains user-setting flags (e.g., specifying system or administrator) and command-execution flags (e.g., cmd, powershell, whoami, wscript, cscript). Such flag combinations are commonly used by legitimate admin utilities but can also indicate attempts to impersonate or execute commands under a different target user. It relies on process creation telemetry and string matches against the CommandLine field for the relevant flag patterns.
references:
- https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_privilege_escalation_cli_patterns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-11-11
tags:
- attack.privilege-escalation
logsource:
category: process_creation
product: windows
detection:
selection_user:
CommandLine|contains:
- " -u system "
- " --user system "
- " -u NT"
- ' -u "NT'
- " -u 'NT"
- " --system "
- " -u administrator "
selection_command:
CommandLine|contains:
- " -c cmd"
- ' -c "cmd'
- " -c powershell"
- ' -c "powershell'
- " --command cmd"
- " --command powershell"
- " -c whoami"
- " -c wscript"
- " -c cscript"
condition: all of selection*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 50d66fb0-03f8-4da0-8add-84e77d12a020
type: derived