LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Mmc.exe

View source

Load snap-ins to locally and remotely manage Windows systems

ExecuteUAC BypassDownload
03COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute1

EXAMPLE 01T1218.014

Launch a 'backgrounded' MMC process and invoke a COM payload

COMMAND
mmc.exe -Embedding {PATH_ABSOLUTE:.msc}
USE CASE
Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 (and possibly earlier versions), Windows 11
Execute · COM

UAC Bypass1

EXAMPLE 01T1218.014

Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC.

COMMAND
mmc.exe gpedit.msc
USE CASE
Modify HKCU\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10 (and possibly earlier versions), Windows 11
Execute · DLL

Download1

EXAMPLE 01T1218.014

Download and save an executable to disk

COMMAND
mmc.exe -Embedding {PATH_ABSOLUTE:.msc}
USE CASE
Download file from Internet
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 (and possibly earlier versions), Windows 11
Application · GUI
02 / ON DISK

Known paths

C:\Windows\System32\mmc.exe
C:\Windows\SysWOW64\mmc.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Jimmy@bohops
clem@clavoillotte
Fredrik H. Brathen