Disclosed hacktool set (old stuff) - file RunAsEx.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy or disclosed hacking tools, specifically the RunAsEx.exe utility, to execute commands with elevated privileges and potentially evade standard detection mechanisms. Proactively hunting for this behavior in Azure Sentinel is critical because known tool signatures often indicate a mature threat actor’s presence, allowing the SOC team to identify early-stage compromise before lateral movement occurs.

YARA Rule

rule sig_238_RunAsEx {
	meta:
		description = "Disclosed hacktool set (old stuff) - file RunAsEx.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "a22fa4e38d4bf82041d67b4ac5a6c655b2e98d35"
	strings:
		$s0 = "RunAsEx By Assassin 2000. All Rights Reserved. http://www.netXeyes.com" fullword ascii
		$s8 = "cmd.bat" fullword ascii
		$s9 = "Note: This Program Can'nt Run With Local Machine." fullword ascii
		$s11 = "%s Execute Succussifully." fullword ascii
		$s12 = "winsta0" fullword ascii
		$s15 = "Usage: RunAsEx <UserName> <Password> <Execute File> [\"Execute Option\"]" fullword ascii
	condition:
		4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the RunAsEx.exe detection rule, including context and suggested filters:

• Scenario: Scheduled Task Execution by Microsoft Deployment Toolkit (MDT)

  • Context: During an enterprise-wide software deployment or OS image refresh, MDT often utilizes RunAsEx.exe to launch installation scripts with elevated privileges for non-admin user contexts. This is a standard part of the provisioning workflow and not indicative of malicious activity.
  • Suggested Filter/Exclusion: Exclude processes where the parent process is MDTDeployment.exe or TaskScheduler.exe (specifically within the \Microsoft\Windows Deployment Services task group). Additionally, exclude if the file path matches C:\ProgramData\Microsoft\MSCCM\Applications\RunAsEx.exe.

• Scenario: Endpoint DLP Agent Policy Enforcement

  • Context: Data Loss Prevention (DLP) agents like Symantec DLP or Microsoft Purview often invoke RunAsEx.exe to enforce policy rules on user documents. When a user saves a sensitive file, the agent may spawn this tool to apply encryption tags or classification labels in an elevated context.
  • Suggested Filter/Exclusion: Create an exclusion for the specific command line arguments containing keywords like “DLP”, “PolicyEnforcement”, or “Classification”. Alternatively, exclude instances where the parent process is Symantec DLP Agent.exe (or equivalent vendor daemon) and the file hash matches a known good baseline.

• Scenario: Group Policy Object (GPO) Script Execution

  • Context: IT administrators frequently configure GPOs to run startup scripts that require specific user context permissions. RunAsEx.exe is commonly used within these scripts to execute configuration tools or registry updates without requiring the local user to be a full domain admin, often triggered during logon events