Bypass UAC via Event Viewer

  1[metadata]
  2creation_date = "2020/03/17"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with
 11elevated permissions.
 12"""
 13from = "now-9m"
 14index = [
 15    "endgame-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-endpoint.events.process-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-system.security*",
 21    "logs-windows.forwarded*",
 22    "logs-windows.sysmon_operational-*",
 23    "winlogbeat-*",
 24]
 25language = "eql"
 26license = "Elastic License v2"
 27name = "Bypass UAC via Event Viewer"
 28risk_score = 73
 29rule_id = "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62"
 30severity = "high"
 31tags = [
 32    "Domain: Endpoint",
 33    "OS: Windows",
 34    "Use Case: Threat Detection",
 35    "Tactic: Privilege Escalation",
 36    "Resources: Investigation Guide",
 37    "Data Source: Elastic Endgame",
 38    "Data Source: Elastic Defend",
 39    "Data Source: Microsoft Defender XDR",
 40    "Data Source: Windows Security Event Logs",
 41    "Data Source: Sysmon",
 42    "Data Source: SentinelOne",
 43    "Data Source: Crowdstrike",
 44    "Noise: Medium",
 45    "Performance: Normal",
 46    "Rule Type: Event Correlation (EQL)",
 47    "Platform: Windows",
 48]
 49timestamp_override = "event.ingested"
 50type = "eql"
 51
 52query = '''
 53process where host.os.type == "windows" and event.type == "start" and
 54  process.parent.name : "eventvwr.exe" and
 55  not process.executable : (
 56        "?:\\Windows\\SysWOW64\\mmc.exe",
 57        "?:\\Windows\\System32\\mmc.exe",
 58        "?:\\Windows\\SysWOW64\\WerFault.exe",
 59        "?:\\Windows\\System32\\WerFault.exe",
 60
 61        /* Crowdstrike specific exclusion as it uses NT Object paths */
 62        "\\Device\\HarddiskVolume*\\Windows\\Sys?????\\mmc.exe",
 63        "\\Device\\HarddiskVolume*\\Windows\\Sys?????\\WerFault.exe"
 64  )
 65'''
 66
 67note = """## Triage and analysis
 68
 69### Investigating Bypass UAC via Event Viewer
 70
 71#### Possible investigation steps
 72
 73- What did Event Viewer launch in the alert?
 74  - Focus: alert time, host/user scope, `process.parent.executable`, `process.executable`, `process.command_line`, and integrity level.
 75  - Implication: escalate when eventvwr.exe launches an unexpected high-integrity child or script/LOLBIN command instead of the normal console or error-reporting helper; lower suspicion only when path normalization proves helper behavior or fields match controlled UAC testing.
 76
 77- Does the child payload identity and command line fit helper behavior or payload execution?
 78  - Focus: `process.executable`, `process.hash.sha256`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.command_line`.
 79  - Hint: use `process.pe.original_file_name` when path, filename, or signer conflicts suggest masquerading.
 80  - Implication: escalate when the child is unsigned, rare, user-writable, signer-mismatched, or runs PowerShell, cmd.exe, rundll32.exe, mshta.exe, wscript.exe, regsvr32.exe, remote retrieval, encoded content, or admin-path writes; lower suspicion only when identity, signer, hash history, and command intent fit controlled testing or helper behavior.
 81
 82- What started Event Viewer, and did the session fit an interactive admin task?
 83  - Focus: recover the Event Viewer start using `host.id` + `process.parent.entity_id`, then review executable, command line, and logon type. $investigate_0
 84  - Hint: if `process.parent.entity_id` is absent, use `host.id` + `process.parent.pid` in a tight `@timestamp` window; PID-only recovery is weaker. Inspect `process.Ext.ancestry` only when direct lineage is incomplete.
 85  - Implication: escalate when Office, browser, archive, scripting, RMM, or remote/noninteractive activity launched Event Viewer; lower suspicion only when launcher and session also support controlled testing or helper behavior. Routine Event Viewer use should open Microsoft Management Console, not an arbitrary child.
 86
 87- Is there corroborating current-user mscfile hijack evidence when process evidence stays suspicious?
 88  - Focus: if registry telemetry exists, review current-user mscfile shell-open command content, creator/deleter process, and timing; HKCU may render as HKEY_USERS\\<user SID>\\Software\\Classes\\mscfile\\shell\\open\\command.
 89  - Hint: use this as corroboration, not as a prerequisite for escalation. Missing registry telemetry is unresolved, not benign; absence of the key after the alert can mean cleanup.
 90  - Implication: escalate or raise confidence when the value points to the alert child, a script interpreter, a temp/user path, or was created or removed around the alert; lower suspicion only when artifact evidence fits the same confirmed test or helper behavior already supported by process evidence.
 91
 92- What did the elevated child do next?
 93  - Focus: child process events where `process.parent.entity_id` matches `process.entity_id`; review executable, command line, and integrity level. $investigate_1
 94  - Hint: prefer entity-ID matches; if only PID matches are available, keep them tightly anchored to `@timestamp`.
 95  - Implication: escalate when the elevated child spawns shells, discovery, credential tools, droppers, installers, persistence helpers, or network-capable tooling; do not close on absent follow-on children when the original command, lineage, or mscfile evidence remains suspicious.
 96
 97- Does the same Event Viewer payload pattern recur beyond this host?
 98  - Range: run only when local process, command, artifact, or lineage evidence remains suspicious or unresolved.
 99  - Focus: `process.hash.sha256`, stable command-line fragments, and `process.executable`, scoped by host and user.
100    - $investigate_2
101    - $investigate_3
102  - Implication: broaden when the same payload or Event Viewer child pattern appears for unrelated hosts or users; keep locally scoped when recurrence is limited to the same confirmed test cohort and no contradictory local evidence remains.
103
104- Based on the evidence gathered, what disposition is supported?
105  - Escalate on strong local abuse signals across child behavior, payload identity, command intent, launcher/session, mscfile artifacts, follow-on children, or scope; close only when process evidence and recovery prove helper normalization or controlled testing; preserve evidence and escalate when registry corroboration is unavailable or evidence is mixed.
106
107### False positive analysis
108
109- This behavior is an operational anti-pattern. Realistic benign paths are controlled UAC testing or a sensor/path-normalization miss for expected Microsoft Management Console (mmc.exe) or Windows Error Reporting (WerFault.exe) child activity. Confirm identity, launcher/session context, command line, and any recovered mscfile artifact support the same benign explanation; if any dimension contradicts it, do not close as benign.
110- Build exceptions from the minimum confirmed pattern: stable child hash or signer, exact Event Viewer parent-child relationship, bounded `user.id` and `host.id`, and test or normalization evidence. Avoid exceptions on `process.parent.name`, `process.name`, or `user.name` alone.
111
112### Response and remediation
113
114- If confirmed benign, document the exact evidence that resolved the alert, reverse temporary containment, and keep any exception scoped to the confirmed child identity, parent-child pattern, and host/user cohort.
115- If suspicious but unconfirmed, preserve the alert, process event exports, Event Viewer parent and child entity IDs, command lines, hashes/signers, recovered mscfile value/history, child process tree, and process-scoped file or network indicators when available.
116- After preservation, apply reversible containment tied to the findings, such as endpoint isolation for non-critical hosts or temporary egress restrictions for confirmed suspicious destinations. Weigh host criticality before isolation.
117- If confirmed malicious, preserve the confirmed hashes/domains/destinations and elevated child process details, then isolate the host as needed, block confirmed malicious indicators, and suspend or terminate malicious processes only after recording their evidence.
118- Eradicate only the artifacts found during triage: remove malicious payloads, restore the current-user mscfile handler to the expected mmc.exe behavior or remove the malicious override, clean related persistence, and remediate the entry vector that launched Event Viewer.
119- Reset credentials or disable accounts only when process/session evidence shows credential exposure, explicit misuse, or attacker use of the affected `user.id`.
120- After eradication, reduce repeat exposure by reviewing local administrator membership, using the highest feasible UAC prompt level, and patching affected Windows builds.
121"""
122
123setup = """## Setup
124
125This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
126
127Setup instructions: https://ela.st/install-elastic-defend
128
129### Additional data sources
130
131This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
132
133- [CrowdStrike](https://ela.st/crowdstrike-integration)
134- [Microsoft Defender XDR](https://ela.st/m365-defender)
135- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
136- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
137- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
138"""
139
140[rule.investigation_fields]
141field_names = [
142    "@timestamp",
143    "host.id",
144    "user.id",
145    "process.entity_id",
146    "process.pid",
147    "process.name",
148    "process.executable",
149    "process.command_line",
150    "process.hash.sha256",
151    "process.code_signature.trusted",
152    "process.Ext.token.integrity_level_name",
153    "process.parent.entity_id",
154    "process.parent.pid",
155    "process.parent.name",
156    "process.parent.executable",
157]
158
159[transform]
160
161[[transform.investigate]]
162label = "Event Viewer parent process event"
163description = ""
164providers = [
165  [
166    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
167    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
168    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
169  ],
170  [
171    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
172    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
173    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
174    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.parent.pid}}", valueType = "string" }
175  ]
176]
177relativeFrom = "now-1h"
178relativeTo = "now"
179
180[[transform.investigate]]
181label = "Process starts from the elevated child"
182description = ""
183providers = [
184  [
185    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
186    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
187    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
188    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
189  ],
190  [
191    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
192    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
193    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
194    { excluded = false, field = "process.parent.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
195  ]
196]
197relativeFrom = "now"
198relativeTo = "now"
199
200[[transform.investigate]]
201label = "Recent process starts with the same child identity"
202description = ""
203providers = [
204  [
205    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
206    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
207    { excluded = false, field = "process.hash.sha256", queryType = "phrase", value = "{{process.hash.sha256}}", valueType = "string" }
208  ],
209  [
210    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
211    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
212    { excluded = false, field = "process.executable", queryType = "phrase", value = "{{process.executable}}", valueType = "string" }
213  ]
214]
215relativeFrom = "now-48h/h"
216relativeTo = "now"
217
218[[transform.investigate]]
219label = "Alerts associated with the user or host"
220description = ""
221providers = [
222  [
223    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
224    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
225  ],
226  [
227    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
228    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
229  ]
230]
231relativeFrom = "now-48h/h"
232relativeTo = "now"
233
234[[rule.threat]]
235framework = "MITRE ATT&CK"
236
237[[rule.threat.technique]]
238id = "T1548"
239name = "Abuse Elevation Control Mechanism"
240reference = "https://attack.mitre.org/techniques/T1548/"
241
242[[rule.threat.technique.subtechnique]]
243id = "T1548.002"
244name = "Bypass User Account Control"
245reference = "https://attack.mitre.org/techniques/T1548/002/"
246
247[rule.threat.tactic]
248id = "TA0004"
249name = "Privilege Escalation"
250reference = "https://attack.mitre.org/tactics/TA0004/"
251
252[[rule.threat]]
253framework = "MITRE ATT&CK"
254
255[[rule.threat.technique]]
256id = "T1548"
257name = "Abuse Elevation Control Mechanism"
258reference = "https://attack.mitre.org/techniques/T1548/"
259
260[[rule.threat.technique.subtechnique]]
261id = "T1548.002"
262name = "Bypass User Account Control"
263reference = "https://attack.mitre.org/techniques/T1548/002/"
264
265[rule.threat.tactic]
266id = "TA0005"
267name = "Defense Evasion"
268reference = "https://attack.mitre.org/tactics/TA0005/"