Hidden PowerShell Launch Followed by Start-Process -Verb RunAs UAC Relaunch

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•2

Detects the execution of a hidden PowerShell process that subsequently spawns a child process using the 'Start-Process' cmdlet with the '-Verb RunAs' argument within a short time window. This pattern is commonly associated with attempts to bypass User Account Control (UAC) or execute processes with elevated privileges silently.