PowerShell UAC-Bypass Elevation via Start-Process -Verb runAs

Duo Tech@duotech

•updated Jul 21, 2026•7•0•6

Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.