High Volume of RunAs Process Creations

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•3

This rule detects an unusually high number of process creations using 'RunAs' within a one-hour window by a single user. A count of 5 or more 'RunAs' commands within an hour could indicate an attempt at privilege escalation or lateral movement, potentially by an attacker trying to execute commands with different user contexts.