Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

SLUI RunAs Elevated

The following analytic detects the execution of the Microsoft Software Licensing User Interface Tool (`slui.exe`) with elevated privileges using the `-verb runas` function. This activity is identified through logs from Endpoint Detection and Response (EDR) agents, focusing on specific registry keys and command-line parameters. This behavior is significant as it indicates a potential privilege escalation attempt, which could allow an attacker to gain elevated access and execute malicious actions with higher privileges. If confirmed malicious, this could lead to unauthorized system changes, data exfiltration, or further compromise of the affected endpoint.

ATT&CK coverage

Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control 86 detections cover this technique

Detection requirements

Log source category: crowdstrike_processrollup2 sysmon_eventid_1 windows_event_log_security_4688

What the source says

What fires this without an attack behind it

Limited false positives should be present as this is not commonly used by legitimate applications.

References

Tagged by the source as

Compromised Windows HostDarkSide RansomwareWindows Defense Evasion TacticsEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.