UAC Bypass via Fodhelper Registry Modification
Detects attempts to bypass User Account Control (UAC) by hijacking the execution flow of the auto-elevated fodhelper.exe binary via modifications to the ms-settings registry keys in the HKCU hive. Silent Stealer leverages this specific registry hijack to seamlessly gain elevated privileges without triggering user prompts, an essential step for its deep credential extraction processes.
Sigma
