Query: alert when Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Se
Matching passage: Sigma rule: Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Se. Logsource: windows / process_creation. Rule: title: PUA - AdvancedRun Suspicious Execution id: fa00b701-44c6-4679-994d-5a18afa8a707 related: - id: d2b749ee-4225-417e-b20e-a8d2193cbb84 type: similar status: test description: Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts references: - https://twitter.com/splinter_code/status/1483815103279603714 - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 - https://www.elastic.co/security-labs/operation-bleeding-bear - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems) date: 2022-01-20 modified: 2023-02-21 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.002 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - /EXEFilename - /CommandLine selection_runas: - CommandLine|contains: - ' /RunAs 8 ' - ' /RunAs 4 ' - ' /RunAs 10 ' - ' /RunAs 11 ' - CommandLine|endswith: - /RunAs 8 - /RunAs 4 - /RunAs 10 - /RunAs 11 condition: all of selection* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user/info.yml
Near-miss passage: Sigma rule: Detects processes that query known 3rd party registry keys that holds credentials via commandline. Logsource: windows / process_creation. Rule: title: Enumeration for 3rd Party Creds From CLI id: 87a476dc-0079-4583-a985-dee7a20a03de related: - id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1 type: derived - id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40 type: similar status: test description: Detects processes that query known 3rd party registry keys that holds credentials via commandline references: - https://isc.sans.edu/diary/More+Data+Exfiltration/25698 - https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt - https://github.com/HyperSine/how-does-MobaXterm-encrypt-password - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2025-05-22 tags: - attack.credential-access - attack.t1552.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \Software\Aerofox\Foxmail\V3.1 - \Software\Aerofox\FoxmailPreview - \Software\DownloadManager\Passwords - \Software\FTPWare\COREFTP\Sites - \Software\IncrediMail\Identities - \Software\Martin Prikryl\WinSCP 2\Sessions - \Software\Mobatek\MobaXterm\ - \Software\OpenSSH\Agent\Keys - \Software\OpenVPN-GUI\configs - \Software\ORL\WinVNC3\Password - \Software\Qualcomm\Eudora\CommandLine - \Software\RealVNC\WinVNC4 - \Software\RimArts\B2\Settings - \Software\SimonTatham\PuTTY\Sessions - \Software\SimonTatham\PuTTY\SshHostKeys\ - \Software\Sota\FFFTP - \Software\TightVNC\Server - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin filter_main_other_rule: Image|endswith: reg.exe CommandLine|contains: - export - save condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium