UAC Bypass via eventvwr/fodhelper/sdclt Spawning Elevated PowerShell
Detects instances where known Windows binaries vulnerable to UAC bypass (eventvwr.exe, fodhelper.exe, or sdclt.exe) spawn a child powershell.exe process with the '-ExecutionPolicy Bypass' argument. This activity is indicative of an attacker attempting to elevate privileges without triggering a UAC prompt.
YARA-L
