Operation DragonReturn DcRAT UAC Bypass via ShellExecuteW runas and fodhelper/eventvwr Registry Keys
This rule detects potential User Account Control (UAC) bypass attempts by monitoring specific registry modifications (ms-settings, mscfile) and the unexpected execution of child processes from high-integrity binaries like fodhelper.exe and eventvwr.exe, or processes launched with the runas command from high-integrity contexts.
Splunk (SPL)
