AdvancedRun Suspicious Execution with Elevated Privileges

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects the execution of the AdvancedRun utility when it attempts to run a process with elevated privileges, specifically in the context of TrustedInstaller, SYSTEM, Local Service, or Network Service accounts. This tool can be used by adversaries for privilege escalation and defense evasion.