Suspicious RunAs-Like Flag Combination for Privilege Escalation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects suspicious command-line flag combinations often used by tools like PsExec to execute commands with elevated privileges, specifically targeting 'system' or 'administrator' accounts. It looks for the presence of user-setting flags ('-u system', '--user system', '-u NT', etc.) combined with command execution flags ('-c cmd', '-c powershell', '-c whoami', etc.). This pattern is indicative of an attempt to escalate privileges or execute commands as a highly privileged user.