Fodhelper.exe Parent Process
This rule detects the execution of a process where the parent process is 'fodhelper.exe'. This behavior can be indicative of privilege escalation or UAC bypass techniques, as fodhelper.exe is a legitimate Windows binary that has been abused by adversaries to execute arbitrary commands with elevated privileges without triggering a UAC prompt. The rule specifically looks for Sysmon EventCode 1 (process creation) where the ParentImage field contains '*\fodhelper.exe'.
Splunk (SPL)
