UAC Bypass via Fodhelper, Computerdefaults, or Slui

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•1

This rule detects potential User Account Control (UAC) bypass attempts by monitoring the creation of processes for 'fodhelper.exe', 'computerdefaults.exe', or 'slui.exe' when their parent process is not 'explorer.exe' or 'svchost.exe'. These executables are known to be used in UAC bypass techniques to elevate privileges without user interaction.