UAC Bypass via eventvwr.exe Spawning Elevated cmd or PowerShell
Detects a User Account Control (UAC) bypass technique where eventvwr.exe is used to spawn an elevated shell (cmd.exe or PowerShell). This occurs because eventvwr.exe is an auto-elevating binary that can be manipulated to execute arbitrary commands with high integrity without displaying a UAC prompt.
YARA-L
