Registry Modification for UAC Bypass via Event Viewer Command Handler (Windows)

title: Registry Modification for UAC Bypass via Event Viewer Command Handler (Windows)
id: 98feafb8-4ab4-43f0-90e5-e3bb7ba3764c
status: test
description: This rule flags registry writes that target the Event Viewer command handler, specifically the registry value path ending in "_Classes\mscfile\shell\open\command\(Default)". Attackers can use this to redirect what Windows executes when invoking the associated handler, supporting UAC bypass techniques. The detection relies on registry set telemetry and matches the targeted value path while excluding events where the command starts with the expected mmc.exe pattern in the SystemRoot directory.
references:
  - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml
author: frack113, Huntrule Team
date: 2022-01-05
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.010
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: _Classes\mscfile\shell\open\command\(Default)
  filter:
    Details|startswith: '%SystemRoot%\system32\mmc.exe "%1" %'
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer/info.yml
simulation:
  - type: atomic-red-team
    name: Bypass UAC using Event Viewer (cmd)
    technique: T1548.002
    atomic_guid: 5073adf8-9a50-4bd9-b298-a9bd2ead8af9
license: DRL-1.1
related:
  - id: 674202d0-b22a-4af4-ae5f-2eda1f3da1af
    type: derived