Fodhelper - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/fodhelper/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 18:22:00 +0000FodHelper UAC Bypass Attempthttps://feed.craftedsignal.io/briefs/2024-01-03-fodhelper-uac-bypass/Wed, 03 Jan 2024 18:22:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-fodhelper-uac-bypass/Detection of fodhelper.exe execution, which is known to exploit User Account Control (UAC) bypass by leveraging specific registry keys, potentially leading to privilege escalation.The fodhelper.exe is a legitimate Windows program located in C:\Windows\System32\. However, it can be abused to bypass User Account Control (UAC) due to its auto-elevated status. When executed, fodhelper.exe can be manipulated to execute arbitrary commands with elevated privileges by modifying specific registry keys. This technique is often employed by threat actors to escalate privileges and perform malicious activities. This behavior is significant because it allows attackers to bypass security controls and gain unauthorized access to the system with administrative rights. This technique has been observed in conjunction with malware such as IcedID, ValleyRAT, and BlankGrabber Stealer.

Attack Chain

  1. An attacker gains initial access to the system, often through phishing or other social engineering techniques.
  2. The attacker executes a script or program that attempts to exploit the Fodhelper UAC bypass.
  3. The malicious script modifies specific registry keys under HKCU\Software\Classes\ms-settings\shell\open\command or HKCU\Software\Classes\CLSID\{F74662A2-2037-4F49-9F00-9312367F9B33}\shell\open\command.
  4. The attacker executes fodhelper.exe.
  5. Due to the registry modifications, when fodhelper.exe runs, it executes the attacker's specified command with elevated privileges.
  6. The attacker leverages the elevated privileges to install malware, create new user accounts with administrative rights, or modify system configurations.
  7. The attacker might then perform lateral movement within the network, seeking to compromise additional systems.
  8. The attacker achieves their final objective, such as data exfiltration, ransomware deployment, or establishing persistent access.

Impact

Successful exploitation of the Fodhelper UAC bypass can lead to complete system compromise. An attacker with elevated privileges can disable security controls, install malware, access sensitive data, and potentially pivot to other systems on the network. Organizations that do not monitor for this type of activity are at increased risk of data breaches, financial losses, and reputational damage. The use of this technique has been observed in conjunction with malware such as IcedID, ValleyRAT, and BlankGrabber Stealer.

Recommendation

  • Enable Sysmon process creation logging to detect the execution of fodhelper.exe and its parent processes.
  • Monitor registry modifications to the HKCU\Software\Classes\ms-settings\shell\open\command or HKCU\Software\Classes\CLSID\{F74662A2-2037-4F49-9F00-9312367F9B33}\shell\open\command keys as mentioned in the attack chain.
  • Deploy the Sigma rules in this brief to your SIEM to detect suspicious process creation events related to fodhelper.exe.
  • Investigate any instances of fodhelper.exe spawning child processes or accessing the registry keys mentioned above.
  • Implement application control policies to restrict the execution of unauthorized or potentially malicious programs.
]]>highadvisoryuac-bypassprivilege-escalationfodhelperwindows