Detectionhightest

Bypass UAC via Fodhelper.exe

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.communityCreated Thu Oct 24Updated Sat Nov 277f741dcf-fc22-4759-87b4-9ae8376676a2windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        ParentImage|endswith: '\fodhelper.exe'
    condition: selection

False Positives

Legitimate use of fodhelper.exe utility by legitimate user

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

7f741dcf-fc22-4759-87b4-9ae8376676a2

Status

test

Level

high

Type

Detection

Created

Thu Oct 24

Modified

Sat Nov 27

Author

Path

rules/windows/process_creation/proc_creation_win_uac_bypass_fodhelper.yml

Raw Tags

attack.defense-evasionattack.privilege-escalationattack.t1548.002