ResiLoader UAC Bypass via ICMLuaUtil Elevated COM Interface

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•4

Detects unauthorized processes attempting to access the ICMLuaUtil Elevated COM interface CLSID. This registry-based activity is indicative of a UAC bypass technique, where malicious actors, such as the ResiLoader threat, gain elevated privileges without triggering a standard UAC consent prompt.