Windows UAC Bypass via Event Viewer RecentViews File Creation
Alerts on suspicious file events to Event Viewer RecentViews paths that may indicate a Windows UAC bypass attempt.
- Product
- windows
- Category
- file_event
- Author
- Antonio Cocomazzi (idea), Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-04-27
- Updated
- 2026-07-31
What it detects
This rule identifies file events where a process creates or writes to Event Viewer RecentViews paths ("\Microsoft\Event Viewer\RecentViews" or the short-path equivalent). Such activity can be used to execute or stage behavior associated with a UAC bypass technique while masquerading as a normal Windows component workflow. It relies on Windows file event telemetry that includes the target filename and the initiating image path, and it filters out actions originating from typical Windows system directories.
Reporting behind it
- twitter.comhttps://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw
- twitter.comhttps://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows UAC Bypass via Event Viewer RecentViews File Creation
id: af2a405b-b7d0-42e9-a72d-0c5f547a5bee
status: test
description: This rule identifies file events where a process creates or writes to Event Viewer RecentViews paths ("\Microsoft\Event Viewer\RecentViews" or the short-path equivalent). Such activity can be used to execute or stage behavior associated with a UAC bypass technique while masquerading as a normal Windows component workflow. It relies on Windows file event telemetry that includes the target filename and the initiating image path, and it filters out actions originating from typical Windows system directories.
references:
- https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw
- https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g
- https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml
author: Antonio Cocomazzi (idea), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-27
modified: 2022-11-22
tags:
- attack.privilege-escalation
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith:
- \Microsoft\Event Viewer\RecentViews
- \Microsoft\EventV~1\RecentViews
filter:
Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43
type: derived