UAC Bypass Using EventVwr
Detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). This method involves manipulating the registry to execute an arbitrary binary or script with elevated privileges when eventvwr.exe is launched. The rule specifically looks for file creation events in the 'RecentViews' directory associated with Event Viewer, where the creating process is not a standard system process (i.e., not originating from C:\Windows\System32\ or C:\Windows\SysWOW64\).
Sigma
