Analytics BIOC Medium
✕

Fodhelper.exe UAC bypass

Attackers may use Fodhelper.exe to bypass UAC (User Account Control) by having it spawn their malicious process.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
Attacker's goals:

Gain higher privileges by bypassing the User Account Control (UAC).

Investigative actions:

Search for a registry event that changes the key Software\Classes\ms-settings. Review the process that made the registry key. Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Test period:
N/A (single event)
Deduplication:
1 Day