Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

eventvwr

UAC Bypass

Privilege Escalation

Defense Evasion

Native Windows Event Viewer launcher (eventvwr.exe). On affected builds, a user who is already in the local Administrators group can arrange for the auto-elevated launcher to resolve HKCU\Software\Classes\mscfile\shell\open\command to a chosen program; launching Event Viewer then starts that program at high integrity without a consent prompt. This is a UAC bypass, not elevation from a standard user to administrator. Windows 10 Insider Preview build 15007 changed eventvwr.exe to launch mmc.exe directly, so build applicability must be checked.

Source

https://support.microsoft.com/en-us/windows/experience/system-configuration-tools-in-windows

References

attack.mitre.org enigma0x3.net lolbas-project.github.io winhelponline.com attack.mitre.org

+2 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER