Potential Fodhelper UAC Bypass (ASIM Version)

Severity: medium
Time window: 2h
Group by: Dvc, TimeKey
Author: Pete Bryan
Source: github.com/Azure/Azure-Sentinel

This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Sysmon	Event ID 5: Process terminated
Sysmon	Event ID 12: RegistryEvent (Object create and delete)
Sysmon	Event ID 13: RegistryEvent (Value Set)
Sysmon	Event ID 14: RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4657: A registry value was modified.
Security-Auditing	Event ID 4663: An attempt was made to access an object.
Security-Auditing	Event ID 4688: A new process has been created.
Security-Auditing	Event ID 4689: A process has exited.
Microsoft Defender for Endpoint	`DeviceRegistryEvents` action `RegistryKeyDeleted`: Registry key deleted
Microsoft Defender for Endpoint	`DeviceRegistryEvents` action `RegistryKeyRenamed`: Registry key renamed
Microsoft Defender for Endpoint	`DeviceRegistryEvents` action `RegistryValueDeleted`: Registry value deleted
Microsoft Defender for Endpoint	`DeviceRegistryEvents` action `RegistryValueSet`: Registry value set

Rule body

id: ac9e233e-44d4-45eb-b522-6e47445f6582
name: Potential Fodhelper UAC Bypass (ASIM Version)
description: |
  'This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.'
severity: Medium
requiredDataConnectors: []
queryFrequency: 2h
queryPeriod: 2h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
relevantTechniques:
  - T1548.002
query: |
  imRegistry
    | where EventType in ("RegistryValueSet", "RegistryKeyCreated")
    | where RegistryKey has "Software\\Classes\\ms-settings\\shell\\open\\command"
    | extend TimeKey = bin(TimeGenerated, 1h)
    | join (imProcess
    | where Process endswith "fodhelper.exe"
    | where ParentProcessName endswith "cmd.exe" or ParentProcessName endswith "powershell.exe" or ParentProcessName endswith "powershell_ise.exe"
    | extend TimeKey = bin(TimeGenerated, 1h)) on TimeKey, Dvc
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DvcHostname
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: DvcIpAddr
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorUsername
version: 1.0.5
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Community
    categories:
        domains: [ "Security - Others" ]

Stages and Predicates

Stage 1: `source`

imRegistry

Stage 2: `where`

| where EventType in ("RegistryValueSet", "RegistryKeyCreated")

Stage 3: `where`

| where RegistryKey has "Software\\Classes\\ms-settings\\shell\\open\\command"

Stage 4: `extend`

| extend TimeKey = bin(TimeGenerated, 1h)

Stage 5: `join`

| join (imProcess
  | where Process endswith "fodhelper.exe"
  | where ParentProcessName endswith "cmd.exe" or ParentProcessName endswith "powershell.exe" or ParentProcessName endswith "powershell_ise.exe"
  | extend TimeKey = bin(TimeGenerated, 1h)) on TimeKey, Dvc

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	in	`RegistryKeyCreated` `RegistryValueSet` corpus 2 (kusto 2)	`field:"EventType" kind:in`
`ParentProcessName`	ends_with	`cmd.exe` corpus 2 (kusto 2) `powershell.exe` corpus 2 (kusto 2) `powershell_ise.exe` corpus 2 (kusto 2)	`field:"ParentImage" kind:ends_with`
`Process`	ends_with	`fodhelper.exe`	`field:"Process" kind:ends_with value:"fodhelper.exe"`
`RegistryKey`	match	`Software\Classes\ms-settings\shell\open\command` transforms: `term` corpus 2 (kusto 2)	`field:"TargetObject" kind:match value:"Software\Classes\ms-settings\shell\open\command"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`TimeKey`	`extend`