Windows Elevation Prompt Bypass via COM Object

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to bypass Windows User Account Control (UAC) elevation prompts by leveraging specific COM objects. It looks for HTTP traffic containing the strings "ICMLuaUtil" and "ShellExec" (case-insensitive) in the file data, which are indicative of this technique. This method is often used by malware to gain elevated privileges without user interaction.