Potentially Suspicious Event Viewer Child Process for UAC Bypass

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a User Account Control (UAC) bypass attempt. The rule specifically filters out legitimate child processes like 'mmc.exe' and 'WerFault.exe' to reduce false positives.