MMC20.Application Lateral Movement Detection

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•21

This rule detects a specific lateral movement technique leveraging the MMC20.Application COM object. It identifies instances where 'mmc.exe' is spawned as a child process of 'svchost.exe' with the command line argument '-Embedding'. This behavior is indicative of the MMC20.Application COM object being used for remote code execution, often for lateral movement within a network.