.. / Mmc.exe
Star

Load snap-ins to locally and remotely manage Windows systems


Paths:


Resources:
https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/

Acknowledgement:
Jimmy - @bohops


Detection:



Execute

Launch a 'backgrounded' MMC process and invoke a COM payload
mmc.exe -Embedding c:\path\to\test.msc
Usecase:Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry
Privileges required:User
OS:Windows 10 (and possibly earlier versions)
Mitre:T1218