LCRYX Ransomware VBScript Self-Elevation via wscript.exe /elevated Flag

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects the execution of wscript.exe with the /elevated argument, where the process was spawned by another wscript.exe instance. This behavior is indicative of potential malicious script execution attempting to bypass normal user execution constraints or using techniques to maintain elevation, often associated with living-off-the-land binaries.