Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
21 detections
Filters
Last updated
All Time
Detection languages
7
4
3
3
2
Contributors
6
4
3
2
2
Categories
13
7
4
3
2
Platforms
19
3
Products / Services
9
4
3
3
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
3
IDS Protocols
3
Detects remote lateral movement attempts using DCOM to launch the Microsoft Management Console (mmc.exe) via svchost.exe (RPCSS/DCOM), followed by mmc.exe spawning an unexpected child process. This pattern indicates potential remote execution and abuse of signed binary proxies for post-exploitation activities.
MMC Spawning Windows Shell
Cortex XDR
Detects instances where the Microsoft Management Console (mmc.exe) launches suspicious child processes often associated with adversary activity, such as command shells, scripting engines, or system management utilities. This behavior is frequently used to proxy execution or perform unauthorized system modifications, with the exception of the standard Task Scheduler snap-in.
Detects HTTP GET requests for .msc (Microsoft Management Console) files, which can be leveraged as part of an attack chain to abuse the mmc.exe binary for proxy execution of malicious configurations.
This rule monitors for potential abuse of the Microsoft Management Console (mmc.exe) to proxy malicious activity. It detects three primary behaviors: 1) mmc.exe being launched with a .msc file originating from user-writable or suspicious directories; 2) mmc.exe spawning known suspicious child processes (e.g., powershell.exe, cmd.exe, rundll32.exe); and 3) the creation or modification of .msc files in suspicious locations by processes other than mmc.exe or msiexec.exe.
This rule detects the execution of potentially malicious processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe) initiated by mmc.exe or explorer.exe, excluding known legitimate Microsoft Management Console (MMC) flags and common management snap-ins. This pattern is indicative of potential proxy execution or misuse of system administration utilities to run unauthorized code.
Detects HTTP GET requests for .msc (Microsoft Management Console) files, which can be leveraged as part of an attack chain to abuse the mmc.exe binary for proxy execution of malicious configurations.
This rule detects the execution of potentially malicious processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe) initiated by mmc.exe or explorer.exe, excluding known legitimate Microsoft Management Console (MMC) flags and common management snap-ins. This pattern is indicative of potential proxy execution or misuse of system administration utilities to run unauthorized code.
This rule monitors for potential abuse of the Microsoft Management Console (mmc.exe) to proxy malicious activity. It detects three primary behaviors: 1) mmc.exe being launched with a .msc file originating from user-writable or suspicious directories; 2) mmc.exe spawning known suspicious child processes (e.g., powershell.exe, cmd.exe, rundll32.exe); and 3) the creation or modification of .msc files in suspicious locations by processes other than mmc.exe or msiexec.exe.
This rule detects the download of a Microsoft Management Console (MMC) snap-in file (.msc) over HTTP that also contains the string "MMCVersion". This combination is often used by attackers to execute malicious code or establish persistence, leveraging the trusted nature of MMC snap-ins. The rule specifically looks for the file extension in the URI and the 'MMCVersion' string within the file's data, indicating a potential malicious MMC snap-in being delivered via HTTP.
Detects MMC used with MSC files for malicious proxy execution
Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt
to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.
to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.
Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.
This rule detects anomalous child processes spawned by mmc.exe. It specifically looks for processes initiated by mmc.exe that are not located in expected system directories or common program file paths, indicating potential abuse of the Microsoft Management Console for malicious execution.
This rule detects the execution of `mmc.exe` with command-line arguments that indicate the use of Right-to-Left Override (RTLO) characters to disguise file extensions. Specifically, it looks for `.msc` files that, due to RTLO abuse, appear to be common document types like `.pdf`, `.doc`, `.xlsx`, etc., but are actually `.msc` files. This technique is often used by adversaries for defense evasion and to trick users into executing malicious files.
Detects when the Microsoft Management Console (MMC) loads scripting engine DLLs such as vbscript.dll, jscript.dll, or jscript9.dll. This activity can indicate an attempt to execute malicious scripts within a trusted system process, potentially for bypassing application whitelisting or defense evasion.
KQL Query
This detection was established prior to our discovery of this new execution technique. It was originally designed to identify a different method (which requires the user to click on the Taskpad after opening the MSC file) that exploits the same MSC file type to execute commands through the Console Taskpads command line attribute:
KQL Query from file: Detect CVE-2024-43572 Abuse
This analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe. This activity is significant as it often indicates lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment.
This analytic identifies `mmc.exe` spawning a Living Off The Land Binaries and Scripts (LOLBAS) execution process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where `mmc.exe` is the parent process. This activity is significant because adversaries can abuse the DCOM protocol and MMC20 COM object to execute malicious code, using Windows native binaries documented by the LOLBAS project. If confirmed malicious, this behavior could indicate lateral movement, allowing attackers to execute code remotely, potentially leading to further compromise and persistence within the environment.
The following analytic detects the loading of an unsigned DLL by the MMC.exe application, which is indicative of a potential UAC bypass or privilege escalation attempt. It leverages Sysmon EventCode 7 to identify instances where MMC.exe loads a non-Microsoft, unsigned DLL. This activity is significant because attackers often use this technique to modify CLSID registry entries, causing MMC.exe to load malicious DLLs, thereby bypassing User Account Control (UAC) and gaining elevated privileges. If confirmed malicious, this could allow an attacker to execute arbitrary code with higher privileges, leading to further system compromise and persistence.