UAC Bypass via Fodhelper HKCU ms-settings Registry Write

Ibrahim Saud@tektrix

•updated Sep 18, 2026•3•0•1

Detects modifications to registry keys under 'Software\Classes\ms-settings' associated with the fodhelper.exe UAC bypass technique, where an adversary manipulates the registry to hijack execution flow and escalate privileges.