Fodhelper.exe Executed by Scripting or Command Interpreter

Jorden Smith@Jorden

•updated Feb 10, 2026•0•18

This rule detects the execution of 'fodhelper.exe' when its parent process is a common scripting or command-line interpreter. This behavior is often associated with UAC bypass techniques, where 'fodhelper.exe' is leveraged to execute arbitrary commands with elevated privileges without prompting the user. The rule specifically looks for 'fodhelper.exe' being launched by 'cmd.exe', 'powershell.exe', 'pwsh.exe', 'wscript.exe', or 'cscript.exe'.