Identifier / Programs / Windows

eventvwr.exe

Event Viewer Snapin Launcher file version info (xCyclopedia)

LOLBAS UAC Bypass 1 Sigma rule name it 1 ATT&CK technique 2 documented commands 12 known copies with hashes

How eventvwr.exe is abused

documented by LOLBAS

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

dataset recentviews copy

-o

-f

-c

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for eventvwr.exe.

2 documented commands

from LOLBAS, each read by the identifier

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control User privileges

During startup, eventvwr.exe checks the registry value HKCU\Software\Classes\mscfile\shell\open\command for the location of mmc.exe, which is used to open the eventvwr.msc saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user.

eventvwr.exe

Identify

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control Administrator privileges

During startup, eventvwr.exe uses .NET deserialization with %LOCALAPPDATA%\Microsoft\EventV~1\RecentViews file. This file can be created using https://github.com/pwntester/ysoserial.net

ysoserial.exe -o raw -f BinaryFormatter - g DataSet -c "{CMD}" > RecentViews & copy RecentViews %LOCALAPPDATA%\Microsoft\EventV~1\RecentViews & eventvwr.exe

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for eventvwr.exe, by Jacob Gajek, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for eventvwr.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

Is it the real eventvwr.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionEvent Viewer Snapin Launcher

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\eventvwr.exe · signed by Microsoft Windows

b8715dda236ec58293119b6ffa621574e35fc5c85b109ff41deae6bd5794fed8

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\eventvwr.exe · signed by Microsoft Windows

de8d3c11177b17a989ce51f0c0dbdf0a493df6f583b0f7e2a5715a28394255e7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\eventvwr.exe · signed by Microsoft Windows

a05f5f53458b25c025d9dacd0864cd07c78d0f1d8496e7d89eacda3f0005120c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\eventvwr.exe · signed by Microsoft Windows

be0d401c8b42024b0918394faa0aa6b494ea537b3c6c2c62c3d9064929f6245b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\eventvwr.exe · signed by Microsoft Windows

9efc59144e49a6c2a08a890310d58fe7279c26e13bc1c7cf346e4dfbcc30dbd5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\eventvwr.exe · signed by Microsoft Windows

e9889f1ae72baa56b628ca59f6179c3e9f57b84043b7c49a50c636337202c9cc

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\eventvwr.exe · signed by Microsoft Windows

963e6a79b77518fa2d4e45604764a5065eb4563f7af7d1526dad76aed49cd96e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\eventvwr.exe · signed by Microsoft Windows

bc87e4f462f00b826ec09ac16b625d0f70439c48fc04a52a41b4cd9e78401f70

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\eventvwr.exe · signed by Microsoft Windows

1501986365ae248c8e4998ecadd52f44acf9e31d05fa10b0c324dc12d4a5c07e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\eventvwr.exe · signed by Microsoft Windows

cf9149e8e5ef6f497d29c2c880a785e6b10c903355b130d1a8454d8d98e46eae

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\eventvwr.exe · not signed

2539f5d1c1adb549b2bbe8d819e3fd7927a65034828aa5606592430cc46dd937

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\eventvwr.exe · not signed

c720c4ed36f041a76f70331be3c2b3b98e1a7d31825d03f5a26e21ba73034b22

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.