Multiple RunAs Attempts for Admin/System Accounts

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•7

This rule detects multiple (3 or more) logon attempts using the 'RunAs' feature (Event ID 4648) for accounts containing 'Admin' or 'SYSTEM' in their username within a one-hour window. This could indicate an adversary attempting to escalate privileges or execute code as a privileged user.