UAC Bypass Attempt via ICMLuaUtil COM Interface (ElevatorShellCode.exe)

Duo Tech@duotech

•updated Jul 9, 2026•1•0•1

Detects the execution of 'ElevatorShellCode.exe' or the presence of 'ICMLuaUtil' in command-line arguments. 'ICMLuaUtil' is a known Windows COM interface frequently abused for UAC bypass and privilege escalation, while 'ElevatorShellCode' is indicative of suspicious tools attempting to gain higher integrity levels.