BQTLock UAC Bypass via EventViewer mscfile Registry Hijack
This rule detects potential User Account Control (UAC) bypass attempts involving eventvwr.exe. It monitors for three suspicious patterns: eventvwr.exe spawning a child process that is not mmc.exe, modification of the HKCU\Software\Classes\mscfile\shell\open\command registry key used for hijacking file associations, and eventvwr.exe being launched from a non-standard system directory.
Splunk (SPL)
