Windows PUA AdvancedRun.exe Execution

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.003Windows Command Shell
Persistence
Priv Esc
- T1134.002Create Process with Token
Defense Evasion
- T1134.002Create Process with Token
- T1564.003Hidden Window
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the executed binary is AdvancedRun.exe and the command line includes specific flags for launching a process with customized window state and execution context. Attackers may use this utility to execute commands in a more stealthy way or with elevated context, blending activity into normal-looking process starts. It relies on Windows process creation telemetry, matching both the OriginalFileName and required command-line fragments.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange

PowerShell Launch With --headless From Conhost.exe on Windows

Suspicious IP Release and Renew via Minimized cmd During Driver Install

Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization

Malicious Metasploit Reverse Shell Injection in SQL Server (via process_creation)

Suspicious Fake Crypto Wallet Installer Batch Script Staging (via file_event)

Obfuscated Encoded PowerShell Payload Deployed via Process Execution (via process_creation)

Operator Bloopers Cobalt Strike Modules

Malicious KB Document Masqueraded Executable Spawned by Script Interpreter via RoKRAT Loader (via process_creation)

Malicious SCMBanker ClickFix Payload Fetch via Curl Piped to Cmd

Windows PUA AdvancedRun.exe Execution

Pivot detection · T1059.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-pua-advancedrun-exe-execution-d2b749ee

title: Windows PUA AdvancedRun.exe Execution
id: 8830181e-a0a7-4fde-ac3d-dea98020a56a
related:
  - id: fa00b701-44c6-4679-994d-5a18afa8a707
    type: similar
  - id: d2b749ee-4225-417e-b20e-a8d2193cbb84
    type: derived
status: test
description: This rule flags process creation events where the executed binary is AdvancedRun.exe and the command line includes specific flags for launching a process with customized window state and execution context. Attackers may use this utility to execute commands in a more stealthy way or with elevated context, blending activity into normal-looking process starts. It relies on Windows process creation telemetry, matching both the OriginalFileName and required command-line fragments.
references:
  - https://twitter.com/splinter_code/status/1483815103279603714
  - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
  - https://www.elastic.co/security-labs/operation-bleeding-bear
  - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-20
modified: 2023-02-21
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1564.003
  - attack.t1134.002
  - attack.t1059.003
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - OriginalFileName: AdvancedRun.exe
    - CommandLine|contains|all:
        - " /EXEFilename "
        - " /Run"
    - CommandLine|contains|all:
        - " /WindowState 0"
        - " /RunAs "
        - " /CommandLine "
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL