Windows UAC Bypass via Event Viewer RecentViews Path in Process Command Line
Flags Windows processes whose command lines reference Event Viewer RecentViews and use redirection, consistent with UAC bypass techniques.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-22
- Updated
- 2026-07-30
What it detects
This rule flags Windows process creation where the command line includes paths referencing Event Viewer RecentViews, including the abbreviated RecentViews directory. It also matches command-line redirection characters, which commonly indicate data being copied or written to the RecentViews location to trigger elevated behavior. The detection relies on process creation telemetry, specifically the full command line content captured at execution time.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-uac-bypass-via-event-viewer-recentviews-path-in-process-command-line-30fc8de7
title: Windows UAC Bypass via Event Viewer RecentViews Path in Process Command Line
id: 58fa72f7-68b1-4ae6-afb8-647bf74b4e8e
related:
- id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43
type: similar
- id: 30fc8de7-d833-40c4-96b6-28319fbc4f6c
type: derived
status: test
description: This rule flags Windows process creation where the command line includes paths referencing Event Viewer RecentViews, including the abbreviated RecentViews directory. It also matches command-line redirection characters, which commonly indicate data being copied or written to the RecentViews location to trigger elevated behavior. The detection relies on process creation telemetry, specifically the full command line content captured at execution time.
references:
- https://twitter.com/orange_8361/status/1518970259868626944
- https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_eventvwr_recentviews.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-22
tags:
- attack.privilege-escalation
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_path:
CommandLine|contains:
- \Event Viewer\RecentViews
- \EventV~1\RecentViews
selection_redirect:
CommandLine|contains: ">"
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1