Potential Privilege Escalation To LOCAL SYSTEM via Command Line
Detects unknown programs attempting to escalate privileges to LOCAL SYSTEM by using command-line arguments commonly associated with tools like PsExec and PAExec. The rule specifically looks for combinations of '-s' (run as SYSTEM) and '-i' (interact with desktop) flags followed by common shell executables like 'cmd', 'pwsh', or 'powershell'. It filters out known instances of 'paexec' and 'PsExec' to avoid overlap with more specific rules.
Sigma
