Millenium RAT UAC Bypass: Integrity Elevation from User-Space with Follow-On Persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects a suspicious sequence where a non-Microsoft signed process running from a user-writable path (e.g., Temp, AppData) spawns a high-integrity or SYSTEM process, followed immediately by persistence activity (modifying Run keys) or the creation of suspicious services/modification of security preferences.