Suspicious RunAs Activity to Privileged Accounts

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•6

Detects multiple instances of a non-SYSTEM or non-LOCAL SERVICE account using 'RunAs' to execute processes as highly privileged accounts (admin, system, root) within a short timeframe. This could indicate an attempt at privilege escalation or token impersonation.