Millenium RAT UAC Bypass via HKCU Registry Hijack + Trusted Binary Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects potential User Account Control (UAC) bypass attempts where a process hijacks registry keys associated with 'ms-settings' or 'mscfile' handlers (commonly used for auto-elevating binaries) and subsequently executes an arbitrary binary from a suspicious location like AppData or Temp.