LCRYX VBScript Ransomware UAC Bypass via Shell.Application ShellExecute /elevated

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects instances where wscript.exe spawns a child process of itself with the /elevated command-line flag, a behavior often indicative of attempts to bypass User Account Control (UAC) or gain elevated script execution privileges.