UAC Bypass via fodhelper.exe or eventvwr.exe Spawning High Integrity Child
Detects attempts to bypass User Account Control (UAC) using fodhelper.exe or eventvwr.exe. This rule specifically looks for these processes initiating other processes with 'High' or 'System' integrity levels, where the initiated process is not fodhelper.exe or eventvwr.exe itself. This behavior is indicative of UAC bypass techniques.
Microsoft Sentinel (KQL)
