Hayabusa high test sigma

PUA - AdvancedRun Suspicious Execution

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection": {
    "CommandLine
| contains": [
      "/EXEFilename",
      "/CommandLine"
    ]
  },
  "selection_runas": [
    {
      "CommandLine
| contains": [
        " /RunAs 8 ",
        " /RunAs 4 ",
        " /RunAs 10 ",
        " /RunAs 11 "
      ]
    },
    {
      "CommandLine
| endswith": [
        "/RunAs 8",
        "/RunAs 4",
        "/RunAs 10",
        "/RunAs 11"
      ]
    }
  ],
  "condition": "process_creation and (all of selection*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...