MMC20 Lateral Movement

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•0•1

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe