Sdclt UAC
Query
DeviceProcessEvents
| where (FileName ==@"sdclt.exe" or ProcessVersionInfoOriginalFileName == @"sdclt.exe") and ProcessCommandLine contains "kickoffelev"Explanation
This query is looking for events related to a specific process called "sdclt.exe" and checking if the process command line contains the term "kickoffelev".