Millenium RAT UAC Bypass via ShellExecuteExW runas verb on cmd.exe
Detects an attempt to bypass User Account Control (UAC) consistent with the Millenium RAT. The rule monitors for the spawning of cmd.exe from non-standard, user-writable directories (such as AppData or Temp) where the parent process launches the shell using the runas verb via ShellExecuteExW with a hidden window, often accompanied by silent command execution.
YARA-L
