Windows PUA AdvancedRun.exe Execution

title: Windows PUA AdvancedRun.exe Execution
id: 8830181e-a0a7-4fde-ac3d-dea98020a56a
related:
  - id: fa00b701-44c6-4679-994d-5a18afa8a707
    type: similar
  - id: d2b749ee-4225-417e-b20e-a8d2193cbb84
    type: derived
status: test
description: This rule flags process creation events where the executed binary is AdvancedRun.exe and the command line includes specific flags for launching a process with customized window state and execution context. Attackers may use this utility to execute commands in a more stealthy way or with elevated context, blending activity into normal-looking process starts. It relies on Windows process creation telemetry, matching both the OriginalFileName and required command-line fragments.
references:
  - https://twitter.com/splinter_code/status/1483815103279603714
  - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
  - https://www.elastic.co/security-labs/operation-bleeding-bear
  - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-20
modified: 2023-02-21
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1564.003
  - attack.t1134.002
  - attack.t1059.003
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - OriginalFileName: AdvancedRun.exe
    - CommandLine|contains|all:
        - " /EXEFilename "
        - " /Run"
    - CommandLine|contains|all:
        - " /WindowState 0"
        - " /RunAs "
        - " /CommandLine "
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/info.yml
license: DRL-1.1