UAC bypass via fodhelper/computerdefaults/eventvwr HKCU classes shell hijack
This rule detects potential User Account Control (UAC) bypass attempts by monitoring for suspicious registry modifications in HKCU\Software\Classes associated with auto-elevating binaries (such as fodhelper.exe, computerdefaults.exe, or eventvwr.exe), followed shortly by the execution of these binaries or their child processes. This pattern is indicative of an adversary attempting to elevate privileges by hijacking the command registry keys used by these trusted Windows binaries.
Microsoft Sentinel (KQL)
