PowerShell UAC Bypass via Start-Process RunAs

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•3

This rule detects the execution of PowerShell with parameters indicating an attempt to elevate privileges using 'Start-Process -Verb RunAs'. This technique can be used to bypass User Account Control (UAC) and execute commands with administrative privileges.