Cross-source coverage
T1218.014 / ATT&CK
System Binary Proxy Execution: MMC
15 rules across 4 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse mmc.exe to proxy execution of malicious.msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created.msc files to manage system configuration.
For example, mmc C:\Users\foo\admintools.msc /a will open a custom, saved console msc file in author mode. Another common example is mmc gpedit.msc, which will open the Group Policy Editor application window.
Adversaries may use MMC commands to perform malicious tasks. For example, mmc wbadmin.msc delete catalog -quiet deletes the backup catalog on the system (i.e. Inhibit System Recovery) without prompts to the user (Note: wbadmin.msc may only be present by default on Windows Server operating systems).
Adversaries may also abuse MMC to execute malicious.msc files. For example, adversaries may first create a malicious registry Class Identifier (CLSID) subkey, which uniquely identifies a Component Object Model class object. Then, adversaries may create custom consoles with the “Link to Web Address” snap-in that is linked to the malicious CLSID subkey. Once the.msc file is saved, adversaries may invoke the malicious CLSID payload with the following command: mmc.exe -Embedding C:\path\to\test.msc.
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:Microsoft-Windows-COM/OperationalWinEventLog:PowerShell
How MITRE says to detect it DET0222
Detecting MMC (.msc) Proxy Execution and Malicious COM Activation
Windows Analytic 0622
Abuse of mmc.exe to execute non-Microsoft or user-staged.msc files and malicious COM CLSIDs. Behavioral chain: (1) suspicious mmc.exe invocation with /a or -Embedding and non-standard.msc path → (2) COM activation of non-baseline CLSIDs by mmc.exe → (3) mmc.exe loads non-baseline DLLs (user-writable/UNC/unsigned) → (4) optional network/DNS activity from mmc.exe.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=12WinEventLog:SysmonEventCode=13, 14WinEventLog:Microsoft-Windows-COM/OperationalCLSID activation events where ProcessName=mmc.exe and CLSID not in allowed baselineWinEventLog:SysmonEventCode=3, 22WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| Mmc LOLBAS Execution Process Spawn | Undefined | SPL |
| Possible Lateral Movement PowerShell Spawn | Undefined | SPL |
| UAC Bypass MMC Load Unsigned Dll | Undefined | SPL |
| Windows Execution of Microsoft MSC File In Suspicious Path | Undefined | SPL |
| Windows GrimResource - MMC Process Accessing APDS DLL | Undefined | SPL |
| Windows Mock Trusted Directory MSC File Creation | Undefined | SPL |
elastic/detection-rules
4 rules| Detection | Severity | Format |
|---|---|---|
| Incoming DCOM Lateral Movement with MMC | High | Elastic TOML |
| Unusual Execution via Microsoft Common Console File | High | Elastic TOML |
| Microsoft Management Console File from Unusual Path | Medium | Elastic TOML |
| UAC Bypass via Windows Firewall Snap-In Hijack | Medium | Elastic TOML |
elastic/protections-artifacts
3 rules| Detection | Severity | Format |
|---|---|---|
| Script Execution via APDS XSS Injection | Undefined | Elastic TOML |
| Suspicious Execution via Microsoft Common Console | Undefined | Elastic TOML |
| Windows Script Execution via MMC Console File | Undefined | Elastic TOML |
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| MMC Executing Files with Reversed Extensions Using RTLO Abuse | High | Sigma |
| MMC Loading Script Engines DLLs | Medium | Sigma |