T1218.014Stealth
MMC
Adversaries may abuse mmc.exe to proxy execution of malicious.msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
2 Sigma rules tagged T1218.014MMCT1218.0142 general rules
- MMC Executing Files with Reversed Extensions Using RTLO Abusehighexperimental
- MMC Loading Script Engines DLLsmediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to MMC
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.