Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts
Read the full analysis on IntelFusions