Operation DragonReturn DcRAT UAC Elevation via runas and MixedSvc Service Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects evidence of UAC bypass via ShellExecuteExW runas elevation from medium-integrity processes located in user-writable paths, followed by the creation of a persistent 'MixedSvc' service using sc.exe, as observed in the Operation DragonReturn campaign involving DcRAT.