ElevatorShellCode.exe ICMLuaUtil UAC bypass yielding elevated child without consent prompt
Detects high-integrity or system-level processes launched by specific shellcode-like filenames or processes containing 'ICMLuaUtil' in the command line. This technique is often indicative of a UAC bypass attempt, where malicious actors attempt to elevate privileges by abusing the ICMLuaUtil COM interface, while excluding the standard Windows consent dialog processes.
Microsoft Sentinel (KQL)
