Bypass UAC via Fodhelper.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•12

This rule detects the use of 'fodhelper.exe' as a parent process. Fodhelper.exe is a legitimate Windows utility that can be abused to bypass User Account Control (UAC) and execute processes with elevated privileges without prompting the user. Adversaries commonly leverage this technique for privilege escalation and defense evasion.