T1218.014 — MMC

Tactic: Stealth · Platforms: Windows

Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.014 System Binary Proxy Execution: MMC

title: "T1218.014 System Binary Proxy Execution: MMC"
id: fa73c454-b9bb-4a63-9a56-a9f85c4ca675
description: 'Detecting MMC (.msc) Proxy Execution and Malicious COM Activation. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, AllowedMSCList, SuspiciousMSCPathRegex, AllowedCLSIDs, ParentProcessAllowList, SignedToUnsignedTransition.'
references:
  - https://attack.mitre.org/techniques/T1218/014
author: Shahrukh Khan
date: 2026-05-14
license: MIT
tags:
  - attack.stealth
  - attack.t1218.014

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    EventID: '1'
    Image|endswith: '\mmc.exe'
  selection_indicator:
    CommandLine|contains:
      - '.msc'
      - '-Embedding'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_indicator and not filter_system_account

falsepositives:
  - Legitimate administrative use of custom or third-party .msc consoles.

level: medium

Related sub-techniques

Explore