Windows UAC Bypass via Event Viewer RecentViews File Creation

Alerts on suspicious file events to Event Viewer RecentViews paths that may indicate a Windows UAC bypass attempt.

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
Antonio Cocomazzi (idea), Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-04-27
Updated
2026-07-31
title: Windows UAC Bypass via Event Viewer RecentViews File Creation
id: af2a405b-b7d0-42e9-a72d-0c5f547a5bee
status: test
description: This rule identifies file events where a process creates or writes to Event Viewer RecentViews paths ("\Microsoft\Event Viewer\RecentViews" or the short-path equivalent). Such activity can be used to execute or stage behavior associated with a UAC bypass technique while masquerading as a normal Windows component workflow. It relies on Windows file event telemetry that includes the target filename and the initiating image path, and it filters out actions originating from typical Windows system directories.
references:
  - https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw
  - https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g
  - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml
author: Antonio Cocomazzi (idea), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-27
modified: 2022-11-22
tags:
  - attack.privilege-escalation
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - \Microsoft\Event Viewer\RecentViews
      - \Microsoft\EventV~1\RecentViews
  filter:
    Image|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43
    type: derived