UAC Bypass Using Event Viewer RecentViews

Rule Info

Name
UAC Bypass Using Event Viewer RecentViews
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the pattern of UAC Bypass using Event Viewer RecentViews
Reference
https://twitter.com/orange_8361/status/1518970259868626944
Date
2022-11-22 00:00:00
Modified
None
Id
30fc8de7-d833-40c4-96b6-28319fbc4f6c
Tags
attack.privilege-escalation attack.stealth
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=30fc8de7-d833-40c4-96b6-28319fbc4f6c

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #5966 from @nasbench - Update mitre tags to use attack v19
2026-04-29
34c5d66c2
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
Nasreddine Bencherchali
feat: updates and enhancements
2023-02-14
27aac9763
Nasreddine Bencherchali
chore: add nextron authors tag
2023-02-01
7c38a5c49
Nasreddine Bencherchali
feat: general fixes
2022-11-22
b6dce4b6a
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022