CTRL toolkit - Hidden PowerShell followed by fodhelper UAC bypass
Detects the initial CTRL execution chain where a malicious LNK launches hidden PowerShell, writes ms-settings UAC bypass registry keys including DelegateExecute, then starts fodhelper.exe. This rule correlates process events for PowerShell executing with a hidden window style and obfuscated commands, registry modifications to the ms-settings UAC bypass key, and the subsequent execution of fodhelper.exe.
Microsoft Sentinel (KQL)
