windows enabled community critical v1.0.0

mmc

Load snap-ins to locally and remotely manage Windows systems Located at: C:\Windows\System32\mmc.exe; C:\Windows\SysWOW64\mmc.exe.

📋 Live Preview

mmc

mmc

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

security.privilege-escalation.uac-bypass

network.transfer.download

Contract

Outputs

process.output

Command execution output

Side effects: privilege_escalationprocess_spawnnetwork_traffic

Workflow Edges

Produces

process.output

Resource Profile

Resource	Value
CPU	low
Memory	16 MB
Network	medium
Disk I/O	low

Examples

Launch a 'backgrounded' MMC process and invoke a COM payload (Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry)

mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC. (Modify HKCU\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.)

mmc.exe gpedit.msc

Download and save an executable to disk (Download file from Internet)

mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

Detection

Type	Rule / Indicator
sigma	https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
sigma	https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml

Documentation

mmc

mmc is a Windows LOLBin. Load snap-ins to locally and remotely manage Windows systems Located at: C:\Windows\System32\mmc.exe; C:\Windows\SysWOW64\mmc.exe.

mmc