Windows MMC20 Lateral Movement via MMC.exe -Embedding spawned by svchost.exe

title: Windows MMC20 Lateral Movement via MMC.exe -Embedding spawned by svchost.exe
id: b02773f0-6bcf-4586-b5a7-65f9946d357c
status: test
description: This rule flags process creation where svchost.exe spawns MMC.exe using a command line containing “-Embedding”. This behavior is consistent with MMC20.Application COM usage to execute or load components through a trusted Windows host, which can support lateral movement. The detection relies on process creation telemetry, matching parent image path, child image path, and the presence of “-Embedding” in the child command line.
references:
  - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view?usp=sharing
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mmc_mmc20_lateral_movement.yml
author: "@2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea), Huntrule Team"
date: 2020-03-04
modified: 2021-11-27
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1021.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \svchost.exe
    Image|endswith: \mmc.exe
    CommandLine|contains: -Embedding
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: f1f3bf22-deb2-418d-8cce-e1a45e46a5bd
    type: derived