Runas Executable Launching PowerShell with Suspicious Child Activity

Daniel Jeremiah@daniyyell

•updated Jul 9, 2026•6•0•15

Detects instances where runas.exe is used to launch PowerShell and monitors subsequent child processes for suspicious commands or activity, such as credential dumping tools, encoded commands, or access to sensitive browser data locations, which may indicate credential theft or unauthorized lateral movement.