Yuta/Glove Stealer UAC Bypass: ms-settings COM Hijack via fodhelper/computerdefaults (T1548.002)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects a potential User Account Control (UAC) bypass by correlating registry value updates in the 'ms-settings' class with the subsequent execution of auto-elevating Windows binaries (fodhelper.exe, computerdefaults.exe, or sdclt.exe) from suspicious locations such as AppData or Temp directories.