From 377c4b40847147957af1fb34910efc5d93ac627d Mon Sep 17 00:00:00 2001 From: hegusung <7390383+hegusung@users.noreply.github.com> Date: Sun, 13 Oct 2024 15:18:35 +0200 Subject: [PATCH] Update Mmc.yml Tags Added tags Execute DLL Input Custom format --- yml/OSBinaries/Mmc.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/yml/OSBinaries/Mmc.yml b/yml/OSBinaries/Mmc.yml index 7dfdb8d..0eb4ee9 100644 --- a/yml/OSBinaries/Mmc.yml +++ b/yml/OSBinaries/Mmc.yml @@ -11,6 +11,9 @@ Commands: Privileges: User MitreID: T1218.014 OperatingSystem: Windows 10 (and possibly earlier versions), Windows 11 + Tags: + - Execute: DLL + - Input: Custom Format - Command: mmc.exe gpedit.msc Description: Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC. Usecase: Modify HKCU\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.