Glove Stealer UAC Bypass: ms-settings Registry Hijack + fodhelper/computerdefaults Child Spawn
This rule detects potential User Account Control (UAC) bypass attempts by monitoring for modifications to specific registry keys (ms-settings\Shell\Open\command) followed by the execution of known auto-elevating Windows binaries like 'fodhelper.exe' or 'computerdefaults.exe'. The rule correlates the registry modification with a subsequent process creation from an suspicious location, indicating a likely attempt to gain elevated privileges.
Cortex XDR
