Windows PUA AdvancedRun.exe Execution
Detects AdvancedRun.exe executions on Windows with /Run and /RunAs style command-line parameters.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-20
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the executed binary is AdvancedRun.exe and the command line includes specific flags for launching a process with customized window state and execution context. Attackers may use this utility to execute commands in a more stealthy way or with elevated context, blending activity into normal-looking process starts. It relies on Windows process creation telemetry, matching both the OriginalFileName and required command-line fragments.
Reporting behind it
- twitter.comhttps://twitter.com/splinter_code/status/1483815103279603714
- medium.comhttps://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
- elastic.cohttps://www.elastic.co/security-labs/operation-bleeding-bear
- winhelponline.comhttps://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PUA AdvancedRun.exe Execution
id: 8830181e-a0a7-4fde-ac3d-dea98020a56a
related:
- id: fa00b701-44c6-4679-994d-5a18afa8a707
type: similar
- id: d2b749ee-4225-417e-b20e-a8d2193cbb84
type: derived
status: test
description: This rule flags process creation events where the executed binary is AdvancedRun.exe and the command line includes specific flags for launching a process with customized window state and execution context. Attackers may use this utility to execute commands in a more stealthy way or with elevated context, blending activity into normal-looking process starts. It relies on Windows process creation telemetry, matching both the OriginalFileName and required command-line fragments.
references:
- https://twitter.com/splinter_code/status/1483815103279603714
- https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
- https://www.elastic.co/security-labs/operation-bleeding-bear
- https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-20
modified: 2023-02-21
tags:
- attack.execution
- attack.privilege-escalation
- attack.stealth
- attack.t1564.003
- attack.t1134.002
- attack.t1059.003
logsource:
product: windows
category: process_creation
detection:
selection:
- OriginalFileName: AdvancedRun.exe
- CommandLine|contains|all:
- " /EXEFilename "
- " /Run"
- CommandLine|contains|all:
- " /WindowState 0"
- " /RunAs "
- " /CommandLine "
condition: selection
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/info.yml
license: DRL-1.1