Lure-Named Payload Self-Elevation via net session Check + RunAs Relaunch from Temp/Downloads Path

Duo Tech@duotech

•updated Aug 5, 2026•4•0•5

Detects lure-named payloads executing from Temp/AppData/Downloads paths that perform a self-elevation check followed by a RunAs relaunch, consistent with the SMOKE#SCREEN campaign's VBScript/batch installer behavior.