PUA - RunXCmd Execution

Title: PUA - RunXCmd Execution
Status: test
Description:Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts
References:
  -https://www.d7xtech.com/free-software/runx/
  -https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
Author: Florian Roth (Nextron Systems)
Date: 2022-01-24
modified:2023-02-14
Tags:

• -'attack.execution'
• -'attack.t1569.002'
• -'attack.s0029'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_account:
    CommandLine|contains:
      -' /account=system '
      -' /account=ti '

  selection_exec:
    CommandLine|contains: '/exec='
  condition:all of selection_*
Falsepositives:
  -Legitimate use by administrators
Level: high