LCRYX Ransomware VBScript UAC Bypass via ShellExecute runas /elevated

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects LCRYX ransomware performing UAC bypass by utilizing VBScript to spawn a new wscript.exe process with elevated privileges. The rule monitors for WScript or CScript processes spawning another WScript process where the command line contains the '/elevated' flag, indicating the use of the Shell.Application object's ShellExecute method with the 'runas' verb.