Update Eventvwr.yml

Category change
This commit is contained in:
Oddvar Moe 2018-12-12 12:45:05 +01:00 committed by GitHub
parent fd44373927
commit 7addc14d7f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -7,7 +7,7 @@ Commands:
- Command: eventvwr.exe
Description: During startup, eventvwr.exe checks the registry value HKCU\Software\Classes\mscfile\shell\open\command for the location of mmc.exe, which is used to open the eventvwr.msc saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user.
Usecase: Execute a binary or script as a high-integrity process without a UAC prompt.
Category: Bypass User Account Control
Category: UAC bypass
Privileges: User
MitreID: T1088
MitreLink: https://attack.mitre.org/wiki/Technique/T1088