LCRYX VBScript UAC Bypass via wscript.exe ShellExecute runas /elevated
Detects the execution of wscript.exe or cscript.exe with the /elevated command-line argument, which is a known technique for bypassing User Account Control (UAC) or invoking administrative tasks via COM object elevation.
Splunk (SPL)
