Windows Registry UAC Bypass via Event Viewer Command Key (mscfile shell open command)

title: Windows Registry UAC Bypass via Event Viewer Command Key (mscfile shell open command)
id: 1cb36f7e-3db1-486b-9959-c70db01e50cd
status: test
description: This rule flags registry modifications to the Windows Event Viewer-related command key under the mscfile\shell\open\command path. Attackers may use this location to redirect how Event Viewer launches associated commands, enabling UAC bypass or privilege escalation. The detection relies on Windows registry set telemetry capturing TargetObject changes ending with '\mscfile\shell\open\command'.
references:
  - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-19
modified: 2023-09-28
tags:
  - attack.privilege-escalation
  - attack.t1548.002
  - car.2019-04-001
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: \mscfile\shell\open\command
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7c81fec3-1c1d-43b0-996a-46753041b1b6
    type: derived