DeadLock UAC Bypass via Randomly-Named 8-Char .cmd RunAs Retry Loop

Ankit Mehta@Secvyn

•updated Aug 11, 2026•0•0•1

Detects the UAC self-elevation behavior associated with DeadLock ransomware, specifically the repeated creation and execution of randomly named 8-character .cmd files in user-writable directories (Temp, ProgramData, AppData). The detection triggers when multiple execution attempts are identified within a short window, suggesting a retry loop when UAC prompts are not immediately accepted.