Remcos RAT UAC Bypass via eventvwr.exe
Detects UAC bypass abuse of eventvwr.exe (Event Viewer) used by Remcos RAT to silently escalate privileges. eventvwr.exe is an auto-elevate COM-based binary; malware spawns it as a child process to gain elevated execution without a UAC prompt. The rule filters out legitimate parent processes like explorer.exe, mmc.exe, taskmgr.exe, and SearchProtocolHost.exe, as well as processes originating from standard Windows system directories.
Microsoft Sentinel (KQL)
