1type: trigger
2name: sigmahq/proc_creation_win_pua_advancedrun_priv_user
3description: |
4  Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.CommandLine contains '/EXEFilename' || evt.Parsed.CommandLine contains '/CommandLine') && (evt.Parsed.CommandLine contains ' /RunAs 8 ' || evt.Parsed.CommandLine contains ' /RunAs 4 ' || evt.Parsed.CommandLine contains ' /RunAs 10 ' || evt.Parsed.CommandLine contains ' /RunAs 11 ' || evt.Parsed.CommandLine endsWith '/RunAs 8' || evt.Parsed.CommandLine endsWith '/RunAs 4' || evt.Parsed.CommandLine endsWith '/RunAs 10' || evt.Parsed.CommandLine endsWith '/RunAs 11'))
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1134.002
15
16  label: "PUA - AdvancedRun Suspicious Execution"
17  behavior : "windows:audit"
18  remediation: false
19
20scope:
21  type: ParentProcessId
22  expression: evt.Parsed.ParentProcessId
23
24