DcRAT UAC Bypass via ShellExecute runas Verb from Mixed Reality.exe

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the execution of 'Mixed Reality.exe' using the 'runas' command-line utility. This pattern is often used to execute binaries with elevated privileges or alternate user contexts, which can be an indicator of potential privilege escalation or lateral movement.