UAC Bypass via fodhelper, eventvwr, or computerdefaults Registry Hijack
Detects attempts to bypass User Account Control (UAC) by spawning processes from fodhelper.exe, eventvwr.exe, or computerdefaults.exe. These executables are known to be vulnerable to UAC bypass techniques, allowing an attacker to elevate privileges without user interaction.
Cortex XDR
