Registry Modification for UAC Bypass via Event Viewer Command Handler (Windows)
Monitors registry value changes to the Event Viewer command handler path indicative of a UAC bypass attempt on Windows.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-05
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry writes that target the Event Viewer command handler, specifically the registry value path ending in "_Classes\mscfile\shell\open\command\(Default)". Attackers can use this to redirect what Windows executes when invoking the associated handler, supporting UAC bypass techniques. The detection relies on registry set telemetry and matches the targeted value path while excluding events where the command starts with the expected mmc.exe pattern in the SystemRoot directory.
Reporting behind it
- enigma0x3.nethttps://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Registry Modification for UAC Bypass via Event Viewer Command Handler (Windows)
id: 98feafb8-4ab4-43f0-90e5-e3bb7ba3764c
status: test
description: This rule flags registry writes that target the Event Viewer command handler, specifically the registry value path ending in "_Classes\mscfile\shell\open\command\(Default)". Attackers can use this to redirect what Windows executes when invoking the associated handler, supporting UAC bypass techniques. The detection relies on registry set telemetry and matches the targeted value path while excluding events where the command starts with the expected mmc.exe pattern in the SystemRoot directory.
references:
- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml
author: frack113, Huntrule Team
date: 2022-01-05
modified: 2023-08-17
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.010
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: _Classes\mscfile\shell\open\command\(Default)
filter:
Details|startswith: '%SystemRoot%\system32\mmc.exe "%1" %'
condition: selection and not filter
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer/info.yml
simulation:
- type: atomic-red-team
name: Bypass UAC using Event Viewer (cmd)
technique: T1548.002
atomic_guid: 5073adf8-9a50-4bd9-b298-a9bd2ead8af9
license: DRL-1.1
related:
- id: 674202d0-b22a-4af4-ae5f-2eda1f3da1af
type: derived