Rule Info
Name
Suspicious RunAs-Like Flag Combination
Author
Florian Roth (Nextron Systems)
Description
Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools
Date
2022-11-11 00:00:00
Modified
None
Id
50d66fb0-03f8-4da0-8add-84e77d12a020
Tags
attack.privilege_escalation DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Scan your endpoints, forensic images or collected files with our portable scanner THOR