BQTLock UAC Bypass via EventViewer COM Hijacking
Detects potential UAC bypass activity involving the hijacking of the Event Viewer (eventvwr.exe) COM object. The rule monitors for registry modifications to the 'HKCU\Software\Classes\mscfile\shell\open\command' key, followed by the execution of 'eventvwr.exe' by a suspicious parent process, indicating an attempt to elevate privileges to perform arbitrary command execution.
Microsoft Sentinel (KQL)
