Windows: MMC spawning command-line executables

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.003Distributed Component Object Model
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation events where MMC (mmc.exe) spawns child executables used for command execution and administration, including cmd.exe, PowerShell (powershell.exe/pwsh.exe), script hosts, and common utilities. Attackers may use MMC as an execution proxy to blend into legitimate management activity while launching command tooling. It relies on process creation telemetry, matching the parent image ending with mmc.exe and the child image ending with specific command-line program names or containing BITSADMIN.

Reporting behind it

Related detections9 linkedT1021.003 — drag to rearrange

Malicious Impacket DCOMexec Process Abuse via MMC (via process_creation)

Malicious Impacket DCOMexec Privilege Abuse via MMC (via security)

DCOM Lateral Movement - Via MMC20 (via powershell)

Suspicious DLL Payload Dropped Under Non-Standard Assembly Directory (via file_event)

Windows SpeechRuntime.exe Child Process Creation

Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths

Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes

Windows Process Creation: Excel DCOM Child Processes Linked to ActivateMicrosoftApp

RPC Firewall detects remote DCOM/WMI-related RPC operations via specified interface UUIDs

Windows: MMC spawning command-line executables

Pivot detection · T1021.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-mmc-spawning-command-line-executables-05a2ab7e

title: "Windows: MMC spawning command-line executables"
id: 221f30cc-c7f6-4309-af61-05c4f036777e
status: test
description: This rule identifies process creation events where MMC (mmc.exe) spawns child executables used for command execution and administration, including cmd.exe, PowerShell (powershell.exe/pwsh.exe), script hosts, and common utilities. Attackers may use MMC as an execution proxy to blend into legitimate management activity while launching command tooling. It relies on process creation telemetry, matching the parent image ending with mmc.exe and the child image ending with specific command-line program names or containing BITSADMIN.
references:
  - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
author: Karneades, Swisscom CSIRT, Huntrule Team
date: 2019-08-05
modified: 2022-07-14
tags:
  - attack.lateral-movement
  - attack.t1021.003
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    ParentImage|endswith: \mmc.exe
  selection2:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
        - \wscript.exe
        - \cscript.exe
        - \sh.exe
        - \bash.exe
        - \reg.exe
        - \regsvr32.exe
    - Image|contains: \BITSADMIN
  condition: all of selection*
level: high
license: DRL-1.1
related:
  - id: 05a2ab7e-ce11-4b63-86db-ab32e763e11d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL