Potentially Suspicious Event Viewer Child Process — Detection Rule

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt