UAC bypass via fodhelper/computerdefaults/eventvwr auto-elevate binaries
Detects instances where known Windows auto-elevate binaries (fodhelper.exe, computerdefaults.exe, eventvwr.exe) are executed without a corresponding UAC consent.exe process. This behavior is indicative of a UAC bypass, often facilitated by registry key modifications (COM hijacking) to manipulate how these binaries are launched.
Splunk (SPL)
