PUA - RunXCmd Execution with Elevated Privileges

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects the execution of the RunXCmd tool when it attempts to run commands with elevated privileges, specifically using the 'System' or 'TrustedInstaller' accounts. This tool is often used for privilege escalation.