PUA - AdvancedRun Execution

Title: PUA - AdvancedRun Execution
Status: test
Description:Detects the execution of AdvancedRun utility
References:
  -https://twitter.com/splinter_code/status/1483815103279603714
  -https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
  -https://www.elastic.co/security-labs/operation-bleeding-bear
  -https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
Author: Florian Roth (Nextron Systems)
Date: 2022-01-20
modified:2023-02-21
Tags:

• -'attack.execution'
• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1564.003'
• -'attack.t1134.002'
• -'attack.t1059.003'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
OriginalFileName:'AdvancedRun.exe'     - CommandLine|contains|all:
      - ' /EXEFilename '
      - ' /Run'
    - CommandLine|contains|all:
      - ' /WindowState 0'
      - ' /RunAs '
      - ' /CommandLine '
  condition:selection
Falsepositives:
  -Unknown
Level: medium