UAC bypass via ICMLuaUtil COM elevation with non-consent token grant (Abyssos)

Duo Tech@duotech

•updated Aug 11, 2026•2•0•2

Detects the Abyssos UAC_BYPASS_ICMLUAUTIL technique: a process referencing the ICMLuaUtil COM interface/CLSID that ends up running at High/System integrity without going through consent.exe.