Displays Windows Event Logs in a GUI window. Located at: C:\Windows\System32\eventvwr.exe; C:\Windows\SysWOW64\eventvwr.exe.
eventvwreventvwrSandbox: execFile · Timeout: 30s
security.privilege-escalation.uac-bypass Outputs
process.output Command execution output
privilege_escalationprocess_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
During startup, eventvwr.exe checks the registry value `HKCU\Software\Classes\mscfile\shell\open\command` for the location of mmc.exe, which is used to open the eventvwr.msc saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. (Execute a binary or script as a high-integrity process without a UAC prompt.)
eventvwr.exeDuring startup, eventvwr.exe uses .NET deserialization with `%LOCALAPPDATA%\Microsoft\EventV~1\RecentViews` file. This file can be created using https://github.com/pwntester/ysoserial.net (Execute a command to bypass security restrictions that limit the use of command-line interpreters.)
ysoserial.exe -o raw -f BinaryFormatter - g DataSet -c "{CMD}" > RecentViews & copy RecentViews %LOCALAPPDATA%\Microsoft\EventV~1\RecentViews & eventvwr.exe| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_uac_bypass_eventvwr.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml |
| elastic | https://github.com/elastic/detection-rules/blob/d31ea6253ea40789b1fc49ade79b7ec92154d12a/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml |
| splunk | https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/eventvwr_uac_bypass.yml |
| ioc | eventvwr.exe launching child process other than mmc.exe |
| ioc | Creation or modification of the registry value HKCU\Software\Classes\mscfile\shell\open\command |
eventvwr is a Windows LOLBin. Displays Windows Event Logs in a GUI window. Located at: C:\Windows\System32\eventvwr.exe; C:\Windows\SysWOW64\eventvwr.exe.