LOL · Binary

Mmc.exe

3 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Launch a 'backgrounded' MMC process and invoke a COM payload

Use Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry

mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218.014
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml
Refs: bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
offsec.almond.consulting/UAC-bypass-dotnet.html
www.youtube.com/watch?v=LFgZOTmhzeA
lolbas-project.github.io/lolbas/Binaries/Mmc/

UAC BypassPrivilege EscalationWindows

Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC.

Use Modify HKCU\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.

mmc.exe gpedit.msc

Evidence: Upstream reference
Environment: Local host
Context: admin
Native: UAC Bypass
MITRE: T1218.014
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml
Refs: bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
offsec.almond.consulting/UAC-bypass-dotnet.html
www.youtube.com/watch?v=LFgZOTmhzeA
lolbas-project.github.io/lolbas/Binaries/Mmc/

File DownloadWindows

Download and save an executable to disk

Use Download file from Internet

mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Download
MITRE: T1218.014
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml
Refs: bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
offsec.almond.consulting/UAC-bypass-dotnet.html
www.youtube.com/watch?v=LFgZOTmhzeA
lolbas-project.github.io/lolbas/Binaries/Mmc/