All Detections

Potential UAC Bypass via ICMLuaUtil

avatar
Daniel Koifman@Koifsec
updated Feb 26, 2026046

The rule detects the execution of dllhost.exe where the command line includes the Class ID (CLSID) for the CMSTPLUA or ICMLuaUtil interfaces.

Splunk (SPL)