UAC Bypass via eventviewer.exe

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•5

Detects attempts to bypass User Account Control (UAC) by abusing 'eventviewer.exe'. This rule specifically looks for 'eventviewer.exe' being initiated by suspicious processes like 'powershell.exe', 'cmd.exe', 'rundll32.exe', or 'Optimax.dll', while excluding legitimate command-line usage of 'eventvwr.exe'.