Command line builds a new logon token for impersonation

Siemphony@siemphonymediumT1134.003unverified

AN1375 is a five-step API/event chain — suspicious command, LogonUser*/ SetThreadToken API evidence, a 4624 New Logon with no interactive desktop, a child process running under the new LogonId, and optional follow-on privileged activity — and lib/sigma has no join, so this rule targets only step (1), the one link in that chain with a command line: MITRE's own example of "runas /netonly" or a "PowerShell P/Invoke of LogonUser". The first selection matches runas.exe invoked with /netonly, which creates a new logon session for an alternate credential without validating it against the domain — the classic CLI proxy for LogonUser-style token creation. The second matches a process command line that names both a token-creation API (LogonUser or LsaLogonUser) and an impersonation API (SetThreadToken or ImpersonateLoggedOnUser) together, the P/Invoke or Add-Type pattern offensive PowerShell tooling uses to call both from a single script passed inline. Neither selection sees the technique when the actual API calls are made in-process by injected or compiled code, or when the PowerShell is wrapped in -EncodedCommand, since the base64 blob hides the literal API names from CommandLine — that path leaves no command-line evidence at all. The brief's second logsource, Security 4672 (Special Privileges Assigned to New Logon), is not used: it fires for every logon carrying an administrative-equivalent privilege set — built-in admins, most service accounts, scheduled tasks, IIS app pools — and it has no process field to filter against MITRE's own AllowedImpersonators knob (winlogon.exe, lsass.exe, IIS worker, trusted service accounts), since 4672 is a logon event, not a process-creation event; without that filter it is far too coarse to carry this technique on its own. Prerequisite: 4688-backed process creation needs *Audit Process Creation* and the separate *Include command line in process creation events* policy, neither on by default. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0498, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\runas.exe" and ProcessCommandLine contains "/netonly") or ((ProcessCommandLine contains "LogonUser" or ProcessCommandLine contains "LsaLogonUser") and (ProcessCommandLine contains "SetThreadToken" or ProcessCommandLine contains "ImpersonateLoggedOnUser")))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\runas.exe" AND CommandLine="*/netonly*") OR ((CommandLine="*LogonUser*" OR CommandLine="*LsaLogonUser*") AND (CommandLine="*SetThreadToken*" OR CommandLine="*ImpersonateLoggedOnUser*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\runas.exe" AND TO_LOWER(process.command_line) LIKE "*/netonly*") OR ((TO_LOWER(process.command_line) LIKE "*logonuser*" OR TO_LOWER(process.command_line) LIKE "*lsalogonuser*") AND (TO_LOWER(process.command_line) LIKE "*setthreadtoken*" OR TO_LOWER(process.command_line) LIKE "*impersonateloggedonuser*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\runas\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)/netonly</field>    <description>Command line builds a new logon token for impersonation (1/2)</description>    <mitre>      <id>T1134.003</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(LogonUser|LsaLogonUser)</field>    <field name="CommandLine" type="pcre2">(?i)(SetThreadToken|ImpersonateLoggedOnUser)</field>    <description>Command line builds a new logon token for impersonation (2/2)</description>    <mitre>      <id>T1134.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: process_injection
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 7e706190-f71b-4a08-b481-2e8a0d769dc3

ATT&CKT1134.003

T1134.003Make and Impersonate Token

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

AN1375 describes a five-step chain: a suspicious command, LogonUser*/ SetThreadToken API evidence, a 4624 New Logon with no interactive desktop, a child process running under the new LogonId, and optional follow-on privileged activity. No join across those steps is possible here, so this rule targets only step one — the single link with a command line — using MITRE's own examples: runas /netonly and a PowerShell P/Invoke of LogonUser.

02 · Telemetry you need

Sysmon or Security 4688 process_creation events with command-line logging. 4688-backed process creation needs Audit Process Creation plus the separate Include command line in process creation events policy — neither is on by default. The brief's second logsource, Security 4672 (Special Privileges Assigned to New Logon), is deliberately not used: it fires on every logon carrying an admin-equivalent privilege set — built-in admins, service accounts, scheduled tasks, IIS app pools — and has no process field to filter against MITRE's own AllowedImpersonators knob (winlogon.exe, lsass.exe, IIS worker, trusted service accounts). Without that filter it's far too coarse on its own.

03 · How the logic works

selection_runas_netonly matches Image ending in \runas.exe with CommandLine containing /netonly — creating a new logon session for an alternate credential without validating it against the domain, the classic CLI proxy for LogonUser-style token creation. selection_psh_logonuser matches a command line containing LogonUser or LsaLogonUser; selection_psh_impersonate matches one containing SetThreadToken or ImpersonateLoggedOnUser. The condition is selection_runas_netonly or (selection_psh_logonuser and selection_psh_impersonate) — the runas branch fires alone, but the PowerShell branch requires both a token-creation API name and an impersonation API name in the same command line, the P/Invoke or Add-Type pattern offensive tooling uses to call both from one inline script. Review flagged that LsaLogonUser is redundant in selection_psh_logonuser since LogonUser is already a substring of it — cosmetic, not a correctness issue, left as self-documentation. Neither branch sees the technique when the API calls happen in-process via injected or compiled code, or when PowerShell is wrapped in -EncodedCommand — the base64 blob hides the literal API names from CommandLine entirely, leaving no command-line evidence at all.

04 · Common false positives

Administrators and help-desk staff running `runas /netonly
Jump-box, PAM and credential-vault clients that shell out to `runas
Authorized red/purple-team or security-tooling PowerShell modules that

05 · Detection maturity

tier_1: Unverified — never run against real logs. This sits at the lowest DeBMM tier until validated against your own telemetry; treat every match as a lead to investigate, not a confirmed detection.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Allowlist known PAM/jump-box process trees and documented admin accounts that use runas /netonly regularly. If you run red-team tooling, exclude its known module paths from the PowerShell branch. Layer PowerShell 4104 script-block logging to catch -EncodedCommand variants this rule cannot reach.

Declared by the author

Administrators and help-desk staff running runas /netonly /user:domain\admin by hand to launch a management console with alternate-domain credentials from a workstation that is not joined to, or not currently authenticated to, that domain — a routine, documented workflow.
Jump-box, PAM and credential-vault client tooling that shells out to runas /netonly to pre-load a vaulted alternate credential before launching a remote-administration console, without disabling UAC.
Authorized red-team, purple-team or security-tooling PowerShell modules (e.g. credential-validation or sandboxed-execution test harnesses) that P/Invoke LogonUser together with SetThreadToken or ImpersonateLoggedOnUser as part of their own legitimate function rather than as an attack.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1134.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/7e706190-f71b-4a08-b481-2e8a0d769dc3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Command line builds a new logon token for impersonation

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it