Bypass UAC Using Event Viewer

Title: Bypass UAC Using Event Viewer
Status: test
Description:Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification
References:
  -https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd
Author: frack113
Date: 2022-01-05
modified:2023-08-17
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1547.010'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: '_Classes\mscfile\shell\open\command\(Default)'
  filter:
    Details|startswith: '%SystemRoot%\system32\mmc.exe "%1" %'
  condition:selection and not filter
Falsepositives:
  -Unknown
Level: high