fodhelper.exe Spawning Unexpected Child Processes

Jorden Smith@Jorden

•updated Jan 8, 2026•0•22

Detects fodhelper.exe spawning unexpected child processes such as command shells or processes from user-writable directories. fodhelper.exe is abused for UAC bypass and should not spawn child processes under normal conditions.