BQTLock-like Fodhelper UAC Bypass Registry Staging
Detects registry modifications consistent with the fodhelper.exe UAC bypass technique (ms-settings handler), which is explicitly referenced in ANY.RUN's BQTLock behavioral writeup.
Sigma
Detects registry modifications consistent with the fodhelper.exe UAC bypass technique (ms-settings handler), which is explicitly referenced in ANY.RUN's BQTLock behavioral writeup.
Already have an account?