huntrule

Windows UAC Bypass via Event Viewer RecentViews File Writes

Alerts on suspicious file events to Event Viewer RecentViews paths that may indicate a Windows UAC bypass attempt.

FreeUnreviewedSigmahighv1
title: Windows UAC Bypass via Event Viewer RecentViews File Writes
id: af2a405b-b7d0-42e9-a72d-0c5f547a5bee
status: test
description: This rule flags file events targeting Windows Event Viewer RecentViews artifacts, which can be used as part of a UAC bypass technique. Attackers may leverage these Event Viewer paths to execute or trigger behavior while attempting to evade normal privilege checks. The detection relies on telemetry for file events on Windows and matches filenames ending with the RecentViews directories while excluding activity from common system binaries.
references:
  - https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw
  - https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g
  - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml
author: Antonio Cocomazzi (idea), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-27
modified: 2022-11-22
tags:
  - attack.privilege-escalation
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - \Microsoft\Event Viewer\RecentViews
      - \Microsoft\EventV~1\RecentViews
  filter:
    Image|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43
    type: derived

What it detects

This rule flags file events targeting Windows Event Viewer RecentViews artifacts, which can be used as part of a UAC bypass technique. Attackers may leverage these Event Viewer paths to execute or trigger behavior while attempting to evade normal privilege checks. The detection relies on telemetry for file events on Windows and matches filenames ending with the RecentViews directories while excluding activity from common system binaries.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.