Windows MMC20 Lateral Movement via MMC.exe -Embedding spawned by svchost.exe

Alerts when svchost.exe launches mmc.exe with “-Embedding”, indicating potential MMC20 COM-based lateral movement.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: @2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea) (SigmaHQ), DRL 1.1
Published: 2020-03-04
Updated: 2026-07-30

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.003Distributed Component Object Model
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where svchost.exe spawns MMC.exe using a command line containing “-Embedding”. This behavior is consistent with MMC20.Application COM usage to execute or load components through a trusted Windows host, which can support lateral movement. The detection relies on process creation telemetry, matching parent image path, child image path, and the presence of “-Embedding” in the child command line.

Reporting behind it

Related detections9 linkedT1021.003 — drag to rearrange

Malicious Impacket DCOMexec Process Abuse via MMC (via process_creation)

Malicious Impacket DCOMexec Privilege Abuse via MMC (via security)

DCOM Lateral Movement - Via MMC20 (via powershell)

Suspicious DLL Payload Dropped Under Non-Standard Assembly Directory (via file_event)

Windows SpeechRuntime.exe Child Process Creation

Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths

Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes

Windows Process Creation: Excel DCOM Child Processes Linked to ActivateMicrosoftApp

RPC Firewall detects remote DCOM/WMI-related RPC operations via specified interface UUIDs

Windows MMC20 Lateral Movement via MMC.exe -Embedding spawned by svchost.exe

Pivot detection · T1021.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-mmc20-lateral-movement-via-mmc-exe-embedding-spawned-by-svchost-exe-f1f3bf22

title: Windows MMC20 Lateral Movement via MMC.exe -Embedding spawned by svchost.exe
id: b02773f0-6bcf-4586-b5a7-65f9946d357c
status: test
description: This rule flags process creation where svchost.exe spawns MMC.exe using a command line containing “-Embedding”. This behavior is consistent with MMC20.Application COM usage to execute or load components through a trusted Windows host, which can support lateral movement. The detection relies on process creation telemetry, matching parent image path, child image path, and the presence of “-Embedding” in the child command line.
references:
  - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view?usp=sharing
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mmc_mmc20_lateral_movement.yml
author: "@2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea), Huntrule Team"
date: 2020-03-04
modified: 2021-11-27
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1021.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \svchost.exe
    Image|endswith: \mmc.exe
    CommandLine|contains: -Embedding
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: f1f3bf22-deb2-418d-8cce-e1a45e46a5bd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL