{"id":"fa00b701-44c6-4679-994d-5a18afa8a707","title":"PUA - AdvancedRun Suspicious Execution","description":"Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-01-20","modified":"2023-02-21","tags":["attack.privilege-escalation","attack.stealth","attack.t1134.002"],"technique_ids":["T1134.002"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://twitter.com/splinter_code/status/1483815103279603714","https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3","https://www.elastic.co/security-labs/operation-bleeding-bear","https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml","source_sha256":"1f2f8c63f76002ec75374e385085920650cb4bb091ddd722bf3152899d8a8846","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - AdvancedRun Suspicious Execution\nid: fa00b701-44c6-4679-994d-5a18afa8a707\nrelated:\n    - id: d2b749ee-4225-417e-b20e-a8d2193cbb84\n      type: similar\nstatus: test\ndescription: Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts\nreferences:\n    - https://twitter.com/splinter_code/status/1483815103279603714\n    - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3\n    - https://www.elastic.co/security-labs/operation-bleeding-bear\n    - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-01-20\nmodified: 2023-02-21\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1134.002\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        CommandLine|contains:\n            - '/EXEFilename'\n            - '/CommandLine'\n    selection_runas:\n        - CommandLine|contains:\n              - ' /RunAs 8 '\n              - ' /RunAs 4 '\n              - ' /RunAs 10 '\n              - ' /RunAs 11 '\n        - CommandLine|endswith:\n              - '/RunAs 8'\n              - '/RunAs 4'\n              - '/RunAs 10'\n              - '/RunAs 11'\n    condition: all of selection*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1134.002","id":"T1134.002","name":"Create Process with Token","page":"techniques/enterprise/T1134.002/"}],"data_path":"data/detection-rules/fa00b701-44c6-4679-994d-5a18afa8a707.json","kind":"sigma"}