Elastic Defend high stable eql

UAC Bypass via FodHelper Execution Hijack

Identifies User Account Control (UAC) bypass via fodhelper.exe execution hijack. Attackers bypass UAC to stealthily execute code with elevated permissions.

View Source

Detection Logic

sequence with maxspan=3m
 [registry where registry.hive == "HKEY_USERS" and registry.data.strings != null and
   registry.key : "*\\ms-settings*"]
 [process where event.action == "start" and process.parent.name : "fodhelper.exe" and
  process.Ext.token.integrity_level_name == "high" and
  not process.executable :
           ("?:\\Windows\\System32\\WerFault.exe",
            "?:\\Windows\\SysWOW64\\WerFault.exe")]

Field Validations

Loading…

Comments (0)

Loading comments...