Abuse of NirSoft AdvancedRun Utility

NirSoft AdvancedRun is a legitimate administration utility designed to execute programs with specific configurations, such as elevated privileges or modified window states. Despite its benign intent, threat actors frequently weaponize this tool to facilitate malicious activities including remote code execution, privilege escalation, and maintaining persistence within compromised environments. Attackers deploy this utility to automate tasks or execute arbitrary commands under elevated tokens, often using it as a precursor for data destruction or ransomware deployment. This activity has been observed in high-impact campaigns, including those involving WhisperGate malware. Defenders should prioritize monitoring for the execution of this utility, as its presence in an enterprise environment - outside of authorized administrative use cases - is a strong indicator of compromise or unauthorized reconnaissance.

Attack Chain

1. Attacker gains initial access to the Windows host through phishing or exploit.
2. AdvancedRun.exe is dropped onto the filesystem, often in directories such as C:\Windows\Temp or user AppData.
3. Attacker executes AdvancedRun.exe using command-line arguments to specify the target binary, configuration files (/cfg), or elevated execution context (/RunAs).
4. AdvancedRun.exe manipulates process token permissions or window visibility states.
5. The target application (e.g., cmd.exe, powershell.exe) is spawned as a child process of AdvancedRun.exe with the specified elevated privileges.
6. Attacker utilizes the elevated shell to execute follow-on payloads, move laterally, or deploy ransomware modules.

Impact

Abuse of AdvancedRun enables attackers to achieve persistent elevated access on infected systems. If successful, this can lead to full system compromise, exfiltration of sensitive organizational data, or large-scale data destruction and ransomware deployment. Historically, this technique has been linked to campaigns targeting major organizations across various sectors, resulting in significant operational disruption and data loss.

Recommendation

• Deploy the Sigma rule below to detect unauthorized execution of AdvancedRun.exe using Sysmon or EDR process creation logs.
• Establish an allowlist for authorized administrative use of AdvancedRun and investigate all other executions by non-administrator users or at unexpected paths.
• Audit environment-wide deployments of the NirSoft toolset to ensure they are constrained to authorized IT and security administrative workstations.