Updated Eventvwr UAC evasion

rules/windows/sysmon/sysmon_uac_bypass_eventvwr.yml

@@ -3,15 +3,23 @@ status: experimental
 description: Detects UAC bypass method using Windows event viewer
 reference: 
     - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
+    - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100
 author: Florian Roth
 logsource:
     product: windows
     service: sysmon
 detection:
-    selection:
+    methregistry:
         EventID: 13
         TargetObject: 'HKEY_USERS\*\mscfile\shell\open\command'
-    condition: selection
+    methprocess:
+        EventID: 1
+        ParentImage: '*\eventvwr.exe'
+    filterprocess:
+        Image: '*\mmc.exe'
+    condition: methregistry or ( methprocess and not filterprocess )
 falsepositives:
     - unknown
 level: critical
+
+