Windows: MMC spawning command-line executables

title: "Windows: MMC spawning command-line executables"
id: 221f30cc-c7f6-4309-af61-05c4f036777e
status: test
description: This rule identifies process creation events where MMC (mmc.exe) spawns child executables used for command execution and administration, including cmd.exe, PowerShell (powershell.exe/pwsh.exe), script hosts, and common utilities. Attackers may use MMC as an execution proxy to blend into legitimate management activity while launching command tooling. It relies on process creation telemetry, matching the parent image ending with mmc.exe and the child image ending with specific command-line program names or containing BITSADMIN.
references:
  - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
author: Karneades, Swisscom CSIRT, Huntrule Team
date: 2019-08-05
modified: 2022-07-14
tags:
  - attack.lateral-movement
  - attack.t1021.003
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    ParentImage|endswith: \mmc.exe
  selection2:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
        - \wscript.exe
        - \cscript.exe
        - \sh.exe
        - \bash.exe
        - \reg.exe
        - \regsvr32.exe
    - Image|contains: \BITSADMIN
  condition: all of selection*
level: high
license: DRL-1.1
related:
  - id: 05a2ab7e-ce11-4b63-86db-ab32e763e11d
    type: derived