VBScript Execution of eventviewer.exe for UAC Bypass

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•2

This rule detects the execution of 'eventviewer.exe' by scripting engines such as 'wscript.exe', 'cscript.exe', or 'vbscript.exe'. This behavior is indicative of a User Account Control (UAC) bypass technique where 'eventviewer.exe' is abused to elevate privileges without user interaction.