fodhelper.exe

• File Path: C:\Windows\system32\fodhelper.exe
• Description: Features On Demand Helper

Hashes

Type	Hash
MD5	4679A1966AABBF229FEC12E3D7A323BD
SHA1	118DEB6CCC9C61043858AF8D7CD304EF1830A860
SHA256	4346962B31D93DD4E8B5164E6167BB030FC0CA7C77EC0BB6AB798A1E8CD9488E
SHA384	D089125BC7C3163DE000C7184B7C3C01EBB3A41C82CD5A0E64EC25FFE0703A47D025B46ABE91C6379A3E4490B6E47D07
SHA512	B24AA37FBF9FE3FECA838BB9389A2B1FD3873E27C9D4A378509C9C40E73DD0475EDA8C4E420FFDD41768ECD3D1C8118519D63E12D66A15A95003D3629E30E323
SSDEEP	768:Mvj4V4fDopm6nh9b/wnbuqLI+2d+czaMl/+X17GS7Nrj0ppJPG8a:k4V2yL1qLIVdrBQXpGS9j+PG5

Signature

• Status: Signature verified.
• Serial: 33000000BCE120FDD27CC8EE930000000000BC
• Thumbprint: E85459B23C232DB3CB94C7A56D47678F58E8E51E
• Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
• Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

• Original Filename: FodHelper.EXE.MUI
• Product Name: Microsoft Windows Operating System
• Company Name: Microsoft Corporation
• File Version: 10.0.14393.0 (rs1_release.160715-1616)
• Product Version: 10.0.14393.0
• Language: English (United States)
• Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of fodhelper.exe being misused. While fodhelper.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	proc_creation_win_uac_fodhelper.yml	title: Bypass UAC via Fodhelper.exe	DRL 1.0
sigma	proc_creation_win_uac_fodhelper.yml	description: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.	DRL 1.0
sigma	proc_creation_win_uac_fodhelper.yml	ParentImage\|endswith: '\fodhelper.exe'	DRL 1.0
sigma	proc_creation_win_uac_fodhelper.yml	- Legitimate use of fodhelper.exe utility by legitimate user	DRL 1.0
sigma	registry_event_shell_open_keys_manipulation.yml	description: Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)	DRL 1.0
malware-ioc	win_apt_invisimole_uac_bypass.yml	- '\fodhelper.exe'	© ESET 2014-2018
atomic-red-team	index.md	- Atomic Test #3: Bypass UAC using Fodhelper [windows]	MIT License. © 2018 Red Canary
atomic-red-team	index.md	- Atomic Test #4: Bypass UAC using Fodhelper - PowerShell [windows]	MIT License. © 2018 Red Canary
atomic-red-team	windows-index.md	- Atomic Test #3: Bypass UAC using Fodhelper [windows]	MIT License. © 2018 Red Canary
atomic-red-team	windows-index.md	- Atomic Test #4: Bypass UAC using Fodhelper - PowerShell [windows]	MIT License. © 2018 Red Canary
atomic-red-team	T1548.002.md	- Atomic Test #3 - Bypass UAC using Fodhelper	MIT License. © 2018 Red Canary
atomic-red-team	T1548.002.md	- Atomic Test #4 - Bypass UAC using Fodhelper - PowerShell	MIT License. © 2018 Red Canary
atomic-red-team	T1548.002.md	## Atomic Test #3 - Bypass UAC using Fodhelper	MIT License. © 2018 Red Canary
atomic-red-team	T1548.002.md	Bypasses User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.	MIT License. © 2018 Red Canary
atomic-red-team	T1548.002.md	fodhelper.exe	MIT License. © 2018 Red Canary
atomic-red-team	T1548.002.md	## Atomic Test #4 - Bypass UAC using Fodhelper - PowerShell	MIT License. © 2018 Red Canary
atomic-red-team	T1548.002.md	PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.	MIT License. © 2018 Red Canary
atomic-red-team	T1548.002.md	Start-Process “C:\Windows\System32\fodhelper.exe”	MIT License. © 2018 Red Canary
atomic-red-team	T1548.002.md	Target: \system32\fodhelper.exe	MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.