UAC Bypass via fodhelper.exe/computerdefaults.exe/eventvwr.exe Auto-Elevation

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•1

Detects potential UAC bypass attempts using common Windows auto-elevate binaries (fodhelper.exe, computerdefaults.exe, eventvwr.exe) that execute suspicious child processes, or by detecting the creation of related registry keys (ms-settings) used for these bypass techniques.