UAC Bypass via Fodhelper/Eventvwr/ComputerDefaults Auto-Elevate Abuse
Detects the execution of known Windows binaries (fodhelper.exe, eventvwr.exe, computerdefaults.exe) which are frequently abused for User Account Control (UAC) bypass by exploiting their auto-elevation capability. These binaries are monitored as either the parent process or the target image, which is a common indicator of a UAC bypass attempt.
CQL
