Mmc.exe

Commands

1. ExecuteUser T1218.014

   Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry

   mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

   Launch a ‘backgrounded’ MMC process and invoke a COM payload

   os: Windows 10 (and possibly earlier versions), Windows 11

   Execute: COM

2. UAC BypassAdministrator T1218.014

   Modify HKCU\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.

   mmc.exe gpedit.msc

   Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC.

   os: Windows 10 (and possibly earlier versions), Windows 11

   Execute: DLL

3. DownloadUser T1218.014

   Download file from Internet

   mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

   Download and save an executable to disk

   os: Windows 10 (and possibly earlier versions), Windows 11

   Application: GUI

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
• Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml

Resources

• https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
• https://offsec.almond.consulting/UAC-bypass-dotnet.html
• https://www.youtube.com/watch?v=LFgZOTmhzeA