Eventvwr.exe · LOLBAS

01 / TRADECRAFT

Command reference

2 examples

UAC Bypass2

During startup, eventvwr.exe checks the registry value `HKCU\Software\Classes\mscfile\shell\open\command` for the location of mmc.exe, which is used to open the eventvwr.msc saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user.

COMMAND

eventvwr.exe

USE CASE: Execute a binary or script as a high-integrity process without a UAC prompt.
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10

Application · GUIExecute · EXE

EXAMPLE 02T1548.002

During startup, eventvwr.exe uses .NET deserialization with `%LOCALAPPDATA%\Microsoft\EventV~1\RecentViews` file. This file can be created using https://github.com/pwntester/ysoserial.net

COMMAND

ysoserial.exe -o raw -f BinaryFormatter - g DataSet -c "{CMD}" > RecentViews & copy RecentViews %LOCALAPPDATA%\Microsoft\EventV~1\RecentViews & eventvwr.exe

USE CASE: Execute a command to bypass security restrictions that limit the use of command-line interpreters.
PRIVILEGES: Administrator
OPERATING SYSTEM: Windows 7, Windows 8, Windows 8.1, Windows 10

Application · GUIExecute · .NetObjects

02 / ON DISK

Known paths

C:\Windows\System32\eventvwr.exe

C:\Windows\SysWOW64\eventvwr.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

5 resources

Indicators & detection notes

IOC
eventvwr.exe launching child process other than mmc.exe
IOC
Creation or modification of the registry value HKCU\Software\Classes\mscfile\shell\open\command

REFERENCE IMPLEMENTATIONS

Code samples

CODEInvoke EventVwrBypass.ps1github.com

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matt Nelson@enigma0x3

Matt Graeber@mattifestation

Orange Tsai@orange_8361