Suspicious RunAs-Like Flag Combination

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools