Payouts King UAC Bypass via fodhelper.exe or eventvwr.exe Child Process
Detects instances where known Windows binaries frequently abused for User Account Control (UAC) bypass (fodhelper.exe, eventvwr.exe) spawn unexpected child processes. These binaries are trusted system utilities that, when used as an actor for launching other processes, often indicate malicious activity aimed at privilege escalation.
Cortex XDR
