BQTLock UAC Bypass via EventViewer mscfile Registry Hijack

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects User Account Control (UAC) bypass attempts where eventvwr.exe is abused via registry modification of HKCU\Software\Classes\mscfile\shell\open\command. The rule identifies suspicious child processes spawned by eventvwr.exe (such as mmc.exe, BQT.exe, or start.exe) that deviate from standard behavior, as observed in BQTLock ransomware activity.