Millenium RAT UAC Bypass — cmd.exe /c whoami via ShellExecuteExW runas

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the execution of 'whoami' via 'cmd.exe' when the parent process is suspicious, such as running from an AppData folder, originating from a suspicious directory named 'Liu5GgJiKiKqe2Qs', or when 'svchost.exe' is executed outside of the standard 'System32' directory. This pattern is commonly used for UAC elevation checks or reconnaissance by malicious software.