.. /Mmc.exe
Star

Execute (COM)
UAC bypass (DLL)
Download (GUI)

Load snap-ins to locally and remotely manage Windows systems

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Launch a ‘backgrounded’ MMC process and invoke a COM payload

    mmc.exe -Embedding {PATH_ABSOLUTE:.msc}
    Use case

    Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry

    Privileges required
    User
    Operating systems
    Windows 10 (and possibly earlier versions), Windows 11
    ATT&CK® technique
    T1218.014
    Tags
    Execute: COM

UAC bypass

  1. Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC.

    mmc.exe gpedit.msc
    Use case

    Modify HKCU\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.

    Privileges required
    Administrator
    Operating systems
    Windows 10 (and possibly earlier versions), Windows 11
    ATT&CK® technique
    T1218.014
    Tags
    Execute: DLL

Download

  1. Download and save an executable to disk

    mmc.exe -Embedding {PATH_ABSOLUTE:.msc}
    Use case

    Download file from Internet

    Privileges required
    User
    Operating systems
    Windows 10 (and possibly earlier versions), Windows 11
    ATT&CK® technique
    T1218.014
    Tags
    Application: GUI