UAC Bypass via Unsafe Deserialization in Event Viewer

file where event.action != "deletion" and file.name : "RecentViews" and
 file.path : "?:\\Users\\*\\AppData\\*\\Microsoft\\Event Viewer\\RecentViews" and
 process.executable != null and
 not process.executable :
            ("?:\\Windows\\System32\\mmc.exe",
             "?:\\Windows\\SysWOW64\\mmc.exe",
             "?:\\Windows\\System32\\svchost.exe",
             "?:\\Windows\\Explorer.exe",
             "?:\\Program Files\\Citrix\\User Profile Manager\\UserProfileManager.exe",
             "?:\\ProgramData\\ForensiT\\Transwiz\\Deployment Files\\Transwiz.exe",
             "?:\\Windows\\WinSxS\\*\\mmc.exe",
             "?:\\Program Files\\*.exe",
             "?:\\Program Files (x86)\\*.exe",
             "?:\\Windows\\System32\\dllhost.exe",
             "?:\\Windows\\System32\\taskhost.exe") and
 not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and 
 not (process.code_signature.subject_name : "ForensiT Limited" and process.code_signature.trusted == true)