detection.wiki

Detection rules › Kusto

Potential Fodhelper UAC Bypass (ASIM Version)

Severity
medium
Time window
2h
Author
Pete Bryan
Source
github.com/Azure/Azure-Sentinel

This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Event coverage

ProviderEvent/ActionTypeTitle
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 14RegistryEvent (Key and Value Rename)
Security-AuditingEvent ID 4657A registry value was modified.
Security-AuditingEvent ID 4660An object was deleted.
Security-AuditingEvent ID 4663An attempt was made to access an object.
Defender-DeviceRegistryEventsRegistryKeyDeletedRegistry key deleted
Defender-DeviceRegistryEventsRegistryValueSetRegistry value set
Defender-DeviceRegistryEventsRegistryValueDeletedRegistry value deleted
Defender-DeviceRegistryEventsRegistryKeyRenamedRegistry key renamed

Rule body kusto

id: ac9e233e-44d4-45eb-b522-6e47445f6582
name: Potential Fodhelper UAC Bypass (ASIM Version)
description: |
  'This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.'
severity: Medium
requiredDataConnectors: []
queryFrequency: 2h
queryPeriod: 2h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
relevantTechniques:
  - T1548.002
query: |
  imRegistry
    | where EventType in ("RegistryValueSet", "RegistryKeyCreated")
    | where RegistryKey has "Software\\Classes\\ms-settings\\shell\\open\\command"
    | extend TimeKey = bin(TimeGenerated, 1h)
    | join (imProcess
    | where Process endswith "fodhelper.exe"
    | where ParentProcessName endswith "cmd.exe" or ParentProcessName endswith "powershell.exe" or ParentProcessName endswith "powershell_ise.exe"
    | extend TimeKey = bin(TimeGenerated, 1h)) on TimeKey, Dvc
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DvcHostname
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: DvcIpAddr
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorUsername
version: 1.0.5
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Community
    categories:
        domains: [ "Security - Others" ]

Stages and Predicates

Stage 1: source

imRegistry

Stage 2: where

| where EventType in ("RegistryValueSet", "RegistryKeyCreated")

Stage 3: where

| where RegistryKey has "Software\\Classes\\ms-settings\\shell\\open\\command"

Stage 4: extend

| extend TimeKey = bin(TimeGenerated, 1h)

Stage 5: join

| join (imProcess
  | where Process endswith "fodhelper.exe"
  | where ParentProcessName endswith "cmd.exe" or ParentProcessName endswith "powershell.exe" or ParentProcessName endswith "powershell_ise.exe"
  | extend TimeKey = bin(TimeGenerated, 1h)) on TimeKey, Dvc

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventTypein
  • RegistryKeyCreated transforms: cased
  • RegistryValueSet transforms: cased corpus 4 (kusto 4)
ParentProcessNameends_with
  • cmd.exe corpus 2 (kusto 2)
  • powershell.exe corpus 2 (kusto 2)
  • powershell_ise.exe corpus 2 (kusto 2)
Processends_with
  • fodhelper.exe
RegistryKeymatch
  • Software\\Classes\\ms-settings\\shell\\open\\command transforms: term corpus 2 (kusto 2)

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
TimeKeyextend