BQTLock UAC Bypass via EventViewer/Fodhelper Registry Hijack (T1548.002)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•8•0•7

Detects User Account Control (UAC) bypass attempts involving registry hijacking of 'mscfile' or 'ms-settings' classes to execute arbitrary commands, and monitors for associated suspicious child process spawning from eventvwr.exe or fodhelper.exe.