UAC Bypass via fodhelper, eventvwr, or sdclt Proxy Execution T1548.002

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects User Account Control (UAC) bypass attempts where known auto-elevating Windows binaries like fodhelper.exe, eventvwr.exe, or sdclt.exe are used as proxy processes to launch child processes with high integrity without user prompts.