LOL · Binary

Mmc.exe

3 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Launch a 'backgrounded' MMC process and invoke a COM payload

Use Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry

mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

Context: user
Native: Execute
MITRE: T1218.014
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml
Refs: bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
offsec.almond.consulting/UAC-bypass-dotnet.html
www.youtube.com/watch?v=LFgZOTmhzeA
lolbas-project.github.io/lolbas/Binaries/Mmc/

UAC BypassPrivilege Escalation Windows

Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC.

Use Modify HKCU\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.

mmc.exe gpedit.msc

Context: admin
Native: UAC Bypass
MITRE: T1218.014
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml
Refs: bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
offsec.almond.consulting/UAC-bypass-dotnet.html
www.youtube.com/watch?v=LFgZOTmhzeA
lolbas-project.github.io/lolbas/Binaries/Mmc/

File Download Windows

Download and save an executable to disk

Use Download file from Internet

mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

Context: user
Native: Download
MITRE: T1218.014
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml
Refs: bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
offsec.almond.consulting/UAC-bypass-dotnet.html
www.youtube.com/watch?v=LFgZOTmhzeA
lolbas-project.github.io/lolbas/Binaries/Mmc/