Windows UAC Bypass via Event Viewer RecentViews Path in Process Command Line

Flags Windows processes whose command lines reference Event Viewer RecentViews and use redirection, consistent with UAC bypass techniques.

FreeUnreviewedSigmahighv1

windows-uac-bypass-via-event-viewer-recentviews-path-in-process-command-line-30fc8de7

title: Windows UAC Bypass via Event Viewer RecentViews Path in Process Command Line
id: 58fa72f7-68b1-4ae6-afb8-647bf74b4e8e
related:
  - id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43
    type: similar
  - id: 30fc8de7-d833-40c4-96b6-28319fbc4f6c
    type: derived
status: test
description: This rule flags Windows process creation where the command line includes paths referencing Event Viewer RecentViews, including the abbreviated RecentViews directory. It also matches command-line redirection characters, which commonly indicate data being copied or written to the RecentViews location to trigger elevated behavior. The detection relies on process creation telemetry, specifically the full command line content captured at execution time.
references:
  - https://twitter.com/orange_8361/status/1518970259868626944
  - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_eventvwr_recentviews.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-22
tags:
  - attack.privilege-escalation
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    CommandLine|contains:
      - \Event Viewer\RecentViews
      - \EventV~1\RecentViews
  selection_redirect:
    CommandLine|contains: ">"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation where the command line includes paths referencing Event Viewer RecentViews, including the abbreviated RecentViews directory. It also matches command-line redirection characters, which commonly indicate data being copied or written to the RecentViews location to trigger elevated behavior. The detection relies on process creation telemetry, specifically the full command line content captured at execution time.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.