Windows Remote Host Computer Management Access

This analytic detects the use of `mmc.exe` to launch Computer Management (`compmgmt.msc`) and connect to a remote machine. This technique allows administrators to access system management tools, including Event Viewer, Services, Shared Folders, and Local Users & Groups, without initiating a full remote desktop session. While commonly used for legitimate administrative purposes, adversaries may leverage this method for remote reconnaissance, privilege escalation, or persistence. Monitoring the execution of `mmc.exe` with the `/computer:{hostname/ip}` argument can help detect unauthorized system administration attempts or lateral movement within a network.