During startup, eventvwr.exe checks the registry value HKCU\Software\Classes\mscfile\shell\open\command for the location
of mmc.exe, which is used to open the eventvwr.msc saved console file. If the location of another binary or script is
added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to
the user.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.