diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml
index d86049b7dc..9669c84655 100644
--- a/detections/endpoint/eventvwr_uac_bypass.yml
+++ b/detections/endpoint/eventvwr_uac_bypass.yml
@@ -40,6 +40,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - IcedID
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 100
   context:
diff --git a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
new file mode 100644
index 0000000000..1d87d7bca4
--- /dev/null
+++ b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
@@ -0,0 +1,63 @@
+name: Windows Eventvwr UAC Bypass
+id: 66adff66-90d9-11ec-aba7-acde48001122
+version: 1
+date: '2022-02-18'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Registry
+description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
+known_false_positives: None known at this time. 
+references:
+-  https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://attack.mitre.org/techniques/T1548/002
+- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - IcedID
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - event_id
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
+  security_domain: endpoint
+  impact: 80
+  confidence: 100 
+  risk_score: 80
+  risk_severity: high
+  context: 
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 14
\ No newline at end of file
diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml
index b422b0def9..f58b522cbe 100644
--- a/detections/endpoint/wsreset_uac_bypass.yml
+++ b/detections/endpoint/wsreset_uac_bypass.yml
@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Living Off The Land 
   confidence: 90
   context:
   - Source:Endpoint
diff --git a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
new file mode 100644
index 0000000000..68f37f6895
--- /dev/null
+++ b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
@@ -0,0 +1,56 @@
+name: Windows WSReset UAC Bypass
+id: 3118f0c2-90d9-11ec-b833-acde48001122
+version: 1
+date: '2022-02-18'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Registry
+description: This analytic is built to detect a suspicious modification of the Windows registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User Account Control.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%") AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); '
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
+known_false_positives: Unknown at this point in time.
+references:
+- https://github.com/hfiref0x/UACME
+- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass 
+tags:
+  analytic_story:
+  - Living Off The Land
+  - Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
+  security_domain: endpoint
+  impact: 70
+  confidence: 90
+  risk_score: 63 
+  risk_severity: medium
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  message: 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 14
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml b/tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml
new file mode 100644
index 0000000000..4ecb8affd8
--- /dev/null
+++ b/tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml
@@ -0,0 +1,10 @@
+name: Windows Eventvwr UAC Bypass Unit Test
+tests:
+- name: Windows Eventvwr UAC Bypass
+  file: endpoint/ssa___windows_eventvwr_uac_bypass.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-sysmon-registry.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file