Eventvwr.exe UAC Bypass via mscfile: Anatomy of a Classic HKCU Registry Hijack

Original text: “Eventvwr.exe UAC Bypass via mscfile” — S12 – 0x12Dark Development, Medium (May 28, 2026). The bypass technique itself was originally documented publicly in 2016 by Matt Nelson (@enigma0x3); it is catalogued as MITRE ATT&CK technique T1548.002. C++ source, AV scan table and figures below are reproduced verbatim with attribution captions.

Executive Summary

The…

https://core-jmp.org/2026/05/eventvwr-uac-bypass-mscfile-hkcu-hijack/