[New WTFBin]: Fodhelper.exe

mttaggart / wtfbins

WTF are these binaries doing?! A list of benign applications that mimic malicious behavior.

MIT License

148 stars 12 forks source link

[New WTFBin]: Fodhelper.exe #2

Closed dievus closed 2 years ago

dievus commented 2 years ago

Contributor Name: Joe Helle
Application/Executable: Fodhelper.exe
WTF Behavior Description: Can be utilized to bypass UAC restrictions to execute commands with high integrity/administrator privileges. While the initial execution triggers Defender due to static rules, execution of the payload is still possible.
Link to Documentation of Behavior: https://medium.themayor.tech/utilizing-a-common-windows-binary-to-escalate-to-system-privileges-c16482cced4b

mttaggart commented 2 years ago

Since this is a legit privesc vector that should be alerted on, we'll leave this off the WTFBins list. Although, a huge WTF for Windows allowing this to still work.

HuskyHacks commented 2 years ago

@dievus it looks like fodhelper is not on the LOLBAS project yet. https://lolbas-project.github.io/#fodhelper