Millenium RAT UAC Bypass via Auto-Elevate COM Registry Hijack
Detects User Account Control (UAC) bypass attempts where a registry key (e.g., ms-settings, mscfile, or Folder shell open command) is created or modified in HKCU, followed within 2 minutes by the execution of an elevated child process (High or System integrity level) by known auto-elevating binaries: fodhelper.exe, computerdefaults.exe, or eventvwr.exe.
Microsoft Sentinel (KQL)
