PUA - AdvancedRun Suspicious Execution

Title: PUA - AdvancedRun Suspicious Execution
Status: test
Description:Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts
References:
  -https://twitter.com/splinter_code/status/1483815103279603714
  -https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
  -https://www.elastic.co/security-labs/operation-bleeding-bear
  -https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
Author: Florian Roth (Nextron Systems)
Date: 2022-01-20
modified:2023-02-21
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1134.002'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    CommandLine|contains:
      -'/EXEFilename'
      -'/CommandLine'

  selection_runas:
    - CommandLine|contains:
      - ' /RunAs 8 '
      - ' /RunAs 4 '
      - ' /RunAs 10 '
      - ' /RunAs 11 '
    - CommandLine|endswith:
      - '/RunAs 8'
      - '/RunAs 4'
      - '/RunAs 10'
      - '/RunAs 11'
  condition:all of selection*
Falsepositives:
  -Unknown
Level: high