UAC Auto-Elevate Bypass via Registry Hijack of fodhelper/computerdefaults/eventvwr
Detects attempts to bypass User Account Control (UAC) by modifying specific registry keys (ms-settings or mscfile) used for shell execution. By hijacking these classes and adding a command, attackers can force a system-native, auto-elevating binary (like fodhelper.exe, eventvwr.exe, or computerdefaults.exe) to execute malicious code with high integrity.
Cortex XDR
