PowerShell Start-Process RunAs Privilege Escalation

Kaung Khant Ko@kaungkhantko

•updated Jun 9, 2026•2•0•8

Detects privilege escalation attempts utilizing PowerShell's Start-Process cmdlet with the 'RunAs' verb. This technique can be used by malware like Lucid Stealer's UAC module to elevate privileges.