MSP360 installer logs aborted UAC elevation via eventcreate.exe
This rule detects instances where the MSP360 RMM Agent installer triggers an UAC elevation failure. The detection specifically monitors the execution of eventcreate.exe, which is often used to log events, when the command line includes strings indicating that the MSP360 installer failed to elevate privileges.
Microsoft Sentinel (KQL)
