BQTLock UAC Bypass via EventViewer COM Hijack (HKCU mscfile)
Detects the BQTLock malware's User Account Control (UAC) bypass technique. This technique involves modifying the registry key HKCU\Software\Classes\mscfile\shell\open\command to hijack the EventViewer COM object. Subsequently, eventvwr.exe is launched, which auto-elevates and executes BQT.exe, bypassing UAC.
Microsoft Sentinel (KQL)
