Operation Poisson UAC Bypass via fodhelper/eventvwr/sdclt or Start-Process RunAs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects common Windows User Account Control (UAC) bypass techniques involving the execution of auto-elevating binaries, the use of PowerShell to launch processes with explicit 'RunAs' verbs, and unauthorized modifications to registry keys within HKCU\Software\Classes.