UAC Bypass via fodhelper.exe Registry Hijack (T1548.002)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects attempts to bypass User Account Control (UAC) by either modifying the registry key associated with the ms-settings protocol handler or by executing the fodhelper.exe binary via cmd.exe. These techniques are commonly used by attackers to gain elevated privileges without triggering a UAC prompt.