runas — Run a Program as Another User

runas.exe is the closest built-in Windows equivalent of Unix sudo: it launches a program under a different user’s credentials from the command line. Unlike sudo, it is strictly an interactive-user tool — there is no policy layer deciding which commands are permitted, only full alternate-credential process creation.

Basic usage

runas /user:$USERNAME $EXECUTABLE
runas /user:$DOMAIN\$USERNAME $EXECUTABLE   # domain account

• $USERNAME may be MACHINE\user, DOMAIN\user, or UPN form.
• $EXECUTABLE resolves normally — via PATH if unqualified, so a full path is only needed for binaries outside the search path.
• Without further flags, runas prompts for the target account’s password.

Flags that matter offensively

Flag	Effect
/savecred	Use credentials previously stored in Credential Manager — no password prompt. Enumerate stored entries first with cmdkey /list; see windows-saved-credentials.
/netonly	Use the supplied credentials only for network authentication; the local process still runs as the current user. Ideal for launching tools that authenticate to remote systems (and for the remote-service token pattern in exploit-windows-services).
/profile / /noprofile	Load or skip the target user’s profile — skipping is faster and leaves fewer artifacts.

The blind-elevation caveat

When a runas-launched reverse shell connects back, whoami on the new shell can mislead: depending on how the shell was staged, it may report the invoking user even while the process token carries the target user’s privileges. Privilege elevation via runas is therefore a blind attack — confirm success by attempting an action that requires the higher privilege (reading a root-only file, net localgroup administrators), not by trusting whoami output alone.

Compared to sudo

	runas	sudo
Granularity	Whole alternate identity	Per-command policy (sudoers)
Auth	Target account password (or /savecred)	Caller’s password, cached briefly
Config	None built-in	/etc/sudoers (see sudo-nopasswd-recon)
Logging	Security EID 4648 (explicit-credential logon)	syslog/auditd

Detection centers on EID 4648 — a logon using explicit credentials — especially from unexpected source accounts or spawning shell/LOLBIN children.

Sources

• Runas — Microsoft Learn
• cmdkey — Microsoft Learn

Related: windows-saved-credentials, sudo-nopasswd-recon, exploit-windows-services, fodhelper-uac-bypass