Operation Poisson: Repeated UAC Elevation via PowerShell Start-Process -Verb RunAs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects anomalous frequency of UAC elevation prompts (consent.exe) initiated by PowerShell. This behavior is indicative of privilege escalation attempts, specifically matching the pattern of repeated Start-Process -Verb RunAs usage to solicit user interaction for UAC elevation.