T1218.014sub-technique of T1218 System Binary Proxy Execution
MMC
Windowsnothing on this site yetT1218.014 on attack.mitre.org
Adversaries may abuse mmc.exe to proxy execution of malicious.msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely.
how MITRE says to see it
Detecting MMC (.msc) Proxy Execution and Malicious COM Activation
- Abuse of mmc.exe to execute non-Microsoft or user-staged.msc files and malicious COM CLSIDs. Behavioral chain: (1) suspicious mmc.exe invocation with /a or -Embedding and non-standard.msc path → (2) COM activation of non-baseline CLSIDs by mmc.exe → (3) mmc.exe loads non-baseline DLLs (user-writable/UNC/unsigned) →...
what reduces it
- M1038 Execution Prevention. Use application control configured to block execution of MMC if it is not required for a given system or network to prevent potential misuse by adversaries.
- M1042 Disable or Remove Feature or Program. MMC may not be necessary within a given environment since it is primarily used by system administrators, not regular users or clients.