# How to check if Application run as administrator **URL:** \ **Category:** SIEM\ **Created:** [May 16, 2023, 2:36am UTC](https://discuss.elastic.co/t/how-to-check-if-application-run-as-administrator/333514 "2023-05-16T02:36:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![target\_test](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/target_test/32/120507_2.png) [@target\_test](https://discuss.elastic.co/u/target_test)\ **Post date:** [May 16, 2023, 2:36am UTC](https://discuss.elastic.co/t/how-to-check-if-application-run-as-administrator/333514/1 "2023-05-16T02:36:38Z")
Hello i have a question Is there any rules to detect if any application run as administrator or if a user run the application as admin in windows machine ? ---
**Author:** ![eMitch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emitch/32/93607_2.png) [@eMitch](https://discuss.elastic.co/u/eMitch)\ **Post date:** [May 17, 2023, 5:18pm UTC](https://discuss.elastic.co/t/how-to-check-if-application-run-as-administrator/333514/2 "2023-05-17T17:18:14Z")
Hi @target_test - In Elastic SIEM, there is a default rule when you import from Elastic for "Unusual Windows User Privilege Elevation Activity". This job detects user privilege escalations which include "run as". Check the [prebuilt ML Jobs here](https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html#:~:text=v3_windows_rare_user_runas_event%5D) - you will see the `v3_windows_rare_user_runas_event` at the bottom of the page. and you can [see the event json here](https://github.com/elastic/kibana/blob/8.7/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_user_runas_event.json) ---
**Author:** ![target\_test](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/target_test/32/120507_2.png) [@target\_test](https://discuss.elastic.co/u/target_test)\ **Post date:** [May 19, 2023, 2:46am UTC](https://discuss.elastic.co/t/how-to-check-if-application-run-as-administrator/333514/3 "2023-05-19T02:46:08Z")
Thank you for the answer @eMitch, After i read page that you have included i found out it need ML to do the work (elastic platinum). Is there any other option other than upgrading to elastic platinum ? ---
**Author:** ![eMitch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emitch/32/93607_2.png) [@eMitch](https://discuss.elastic.co/u/eMitch)\ **Post date:** [May 24, 2023, 2:13pm UTC](https://discuss.elastic.co/t/how-to-check-if-application-run-as-administrator/333514/4 "2023-05-24T14:13:13Z")
Hey @target_test - Not that I'm aware of. Elastic Machine Learning requires Platinum licensing. ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [May 25, 2023, 5:28pm UTC](https://discuss.elastic.co/t/how-to-check-if-application-run-as-administrator/333514/5 "2023-05-25T17:28:51Z")
You could just make a custom Elastic SIEM rule to monitor it without ml, see [https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648) ---
**Author:** ![target\_test](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/target_test/32/120507_2.png) [@target\_test](https://discuss.elastic.co/u/target_test)\ **Post date:** [May 26, 2023, 1:47am UTC](https://discuss.elastic.co/t/how-to-check-if-application-run-as-administrator/333514/6 "2023-05-26T01:47:14Z")
Thanks for the information ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 23, 2023, 1:47am UTC](https://discuss.elastic.co/t/how-to-check-if-application-run-as-administrator/333514/7 "2023-06-23T01:47:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.