DcRAT UAC Bypass via runas Verb and Global\ShitSetupOn26126k Mutex

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects potential UAC bypass or privilege escalation attempts involving the 'runas' command. The rule identifies suspicious process patterns such as non-standard parent processes invoking runas, self-relaunching applications with elevated command-line flags, and specific executable naming conventions associated with known threat actor activities.