Event Details High

Event Summary
Event ID

6

Risk Score
85.25
Status
Active
Timestamp

Security Source

CrowdStrike Falcon (EDR)

Risk Category

Privilege Escalation

User Information
M
mallen

[email protected]

Department

Engineering

Job Title

Production Developer I

View User Risk Profile
Mitigations
No mitigations have been applied to this event.
Event Details
Device Id LAPTOP-KPT123
Technique UAC Bypass
Command Line eventvwr.exe
Detection Id CS34567890
Process Name eventvwr.exe
Child Process cmd.exe
Child Command Line cmd.exe /c net localgroup administrators kpatel /add
Raw JSON Data
{
  "child_command_line": "cmd.exe /c net localgroup administrators kpatel /add",
  "child_process": "cmd.exe",
  "command_line": "eventvwr.exe",
  "detection_id": "CS34567890",
  "device_id": "LAPTOP-KPT123",
  "process_name": "eventvwr.exe",
  "technique": "UAC Bypass"
}