Operation Poisson UAC Bypass via Start-Process -Verb RunAs

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•6

Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.