BQTLock UAC Bypass via EventViewer Registry Hijack (HKCU\mscfile)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a User Account Control (UAC) bypass technique where an adversary modifies the registry keys (HKCU\Software\Classes\mscfile\shell\open\command) to intercept execution when eventvwr.exe is launched. The rule identifies the suspicious registry write followed by the subsequent execution of a child process (like BQT.exe or start.exe) originating from eventvwr.exe.