critical Sigma Windows

UAC Bypass via Fodhelper Registry Hijack

Creation of the HKCU ms-settings shell open command key, the hijack that makes auto-elevating fodhelper.exe run an attacker binary with no consent prompt.

Rule source

uac-bypass-fodhelper.yml

title: UAC Bypass via Fodhelper Registry Hijack
id: 9e2a7d54-31bc-4f06-8ab9-5c7e40d1f238
status: stable
description: >
  Creation of the HKCU ms-settings shell open command key, the hijack that makes
  auto-elevating fodhelper.exe run an attacker binary at high integrity without
  a consent prompt.
references:
  - https://attack.mitre.org/techniques/T1548/002/
author: DetectionOps
date: 2026/09/06
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains:
      - '\Software\Classes\ms-settings\shell\open\command'
      - '\Software\Classes\ms-settings\CurVer'
      - '\Software\Classes\mscfile\shell\open\command'
  filter_empty_delete:
    Details: '(Empty)'
  condition: selection and not filter_empty_delete
fields:
  - TargetObject
  - Details
  - Image
  - User
falsepositives:
  - Rare. Treat a hit as suspicious until the writing process is explained.
level: critical
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
  - attack.t1548.002

Required telemetry

Sysmon - Event ID 13 (registry value set)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Rare. Treat any hit as suspicious until the writing process is explained.

Validation

Atomic Red Team T1548.002-4 and -5, re-run after each Windows feature update

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.