Operation DragonReturn DcRAT UAC Bypass via ShellExecuteW runas Verb
Detects a suspicious UAC bypass pattern associated with the DcRAT malware, where a process relaunches itself using the 'runas' verb via ShellExecuteW to escalate privileges. The rule specifically monitors for instances where an executable triggers a secondary process launch of itself, filtering out standard Windows administrative utility parents.
YARA-L
