Operation Poisson: UAC Bypass Enabling OpenSSH/Tailscale Installation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects various User Account Control (UAC) bypass techniques (such as fodhelper.exe or eventvwr.exe hijacking), registry modifications involving 'ms-settings' classes, and the use of 'Start-Process -Verb RunAs' to request administrative privileges. It also flags potentially elevated installations of OpenSSH or Tailscale, which are commonly targeted by attackers following privilege escalation.