BQTLock UAC Bypass via EventViewer Registry Hijack (T1548.002)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the UAC bypass technique employed by the BQTLock ransomware, where the registry key 'HKCU\Software\Classes\mscfile\shell\open\command' is hijacked to execute arbitrary binaries such as BQT.exe or malicious scripts via eventvwr.exe, effectively elevating privileges.