UAC bypass via fodhelper/computerdefaults auto-elevated COM hijack
Detects a registry hijack of the 'ms-settings\Shell\Open\command' key, followed by the execution of auto-elevated binaries 'fodhelper.exe' or 'computerdefaults.exe'. The rule identifies potential UAC bypass attempts by correlating these registry modifications with the subsequent spawning of an unsigned or unrecognized child process by the auto-elevated binary.
Microsoft Sentinel (KQL)
