Ethersphere Node/Electron UAC elevation loop or post-elevation actions
Detects potential User Account Control (UAC) bypass attempts or privilege elevation loops initiated by node.exe, electron.exe, or Swarm Desktop.exe, followed by suspicious post-elevation actions such as modifying Defender preferences, executing msiexec with app.msi, or invoking ScreenConnect Client.
Microsoft Sentinel (KQL)
