All Detections

Registry Hijack for UAC Bypass via ms-settings

avatar
Jorden Smith@Jorden
updated Jan 8, 2026023

Detects modification of ms-settings Shell\Open\command registry key used for UAC bypass via fodhelper.exe. This registry key should never be modified by legitimate software.

Sigma