Millenium RAT UAC Bypass via ShellExecuteExW runas Verb on cmd.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects Millenium RAT attempting to bypass User Account Control (UAC) by spawning cmd.exe with the 'runas' verb via ShellExecuteExW. The rule specifically looks for cmd.exe processes running in High integrity, spawned from non-standard parent processes, while executing commands such as 'whoami'.