Starland RAT UAC Elevation via ShellExecuteW runas Verb
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Sigma
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Already have an account?