Operation Poisson UAC Bypass via fodhelper/eventvwr for Tailscale/OpenSSH Install

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•10

Detects specific User Account Control (UAC) bypass techniques involving fodhelper.exe, eventvwr.exe, and sdclt.exe, often used in conjunction with PowerShell 'RunAs' elevation to install system-level tools like Tailscale or OpenSSH, as observed in Operation Poisson.