Microsoft Management Console, mmc.exe, is the host for administrative snap-ins on Windows. It may be signed by Microsoft and can create, open and save custom consoles. MITRE ATT&CK tracks its abuse as T1218.014, MMC, in the Stealth tactic, on Windows.
How attackers use it
MMC opens .msc files to manage system configuration, locally or remotely. MITRE gives ordinary examples, such as opening a saved console in author mode, or opening the Group Policy Editor.
Adversaries may use MMC to run malicious tasks. One example on the MITRE page uses a backup administration console to delete the backup catalog without prompts, which is Inhibit System Recovery. That console may only be present by default on Windows Server.
Adversaries may also use MMC to execute malicious .msc files. As MITRE describes it, they create a malicious registry Class Identifier (CLSID) subkey, build a custom console with the Link to Web Address snap-in tied to that CLSID, save the .msc file, and later invoke the CLSID payload by running mmc.exe in embedding mode against that file.
How to detect it
The MITRE strategy looks for four things in a chain:
- A suspicious mmc.exe invocation, using author mode or embedding mode, with a non-standard .msc path.
- COM activation of CLSIDs that are not part of your baseline.
- mmc.exe loading non-baseline DLLs, for example from user writable folders, UNC paths or unsigned files.
- Optional network or DNS activity from mmc.exe.
Process creation with command lines, registry telemetry for new CLSID subkeys (Sysmon event ID 13) and image loads (event ID 7) give you the evidence. MMC usually runs on admin workstations. If it runs on a standard user laptop with a custom .msc file from a Downloads folder, that is worth a look.
How to reduce the risk
- Disable or remove MMC where it is not needed. MITRE notes it is primarily used by system administrators and not by regular users.
- Use application control to block mmc.exe where it is not required.
Check your own environment
- Which user groups truly need MMC?
- Is mmc.exe blocked or restricted on standard user devices?
- Can you see command lines for mmc.exe launches?
This read-only PowerShell command lists recent Security log process creation events mentioning mmc, if command line auditing is on:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 200 | Where-Object { $_.Message -match 'mmc' } | Select-Object TimeCreated, Message
Where to start
Count the people who really use MMC, which is usually a short list of administrators. For everyone else, block mmc.exe with application control. For the administrators, keep the alert on custom .msc files from user writable paths and on author mode launches, and record which snap-ins and consoles your team normally opens so you can compare.
Quick check
Why is a custom .msc file in a user folder suspicious?
Administrative consoles normally come from Microsoft or from managed locations. A user staged .msc file may link to a malicious COM object.
Sources
- MITRE ATT&CK, T1218.014: https://attack.mitre.org/techniques/T1218/014
