Potential UAC Bypass via ICMLuaUtil

Daniel Koifman@Koifsec

•updated Feb 2, 2026•3•0•45

The rule detects the execution of dllhost.exe where the command line includes the Class ID (CLSID) for the CMSTPLUA or ICMLuaUtil interfaces.