diff --git a/yml/OSBinaries/Mmc.yml b/yml/OSBinaries/Mmc.yml new file mode 100644 index 0000000..be1fe32 --- /dev/null +++ b/yml/OSBinaries/Mmc.yml @@ -0,0 +1,28 @@ +--- +Name: Mmc.exe +Description: +Author: '@bohops' +Created: '2018-12-04' +Commands: + - Command: mmc.exe -Embedding c:\path\to\test.msc + Description: Load snap-ins to locally and remotely manage Windows systems + Usecase: Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry. + Category: Execute + Privileges: User + MitreID: T1218 + MitreLink: https://attack.mitre.org/wiki/Technique/T1218 + OperatingSystem: Windows 10 (and possibly earlier versions) + +Full Path: + - Path: C:\Windows\System32\mmc.exe + - Path: C:\Windows\SysWOW64\mmc.exe +Code Sample: +- Code: +Detection: + - IOC: +Resources: + - Link: https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ +Acknowledgement: + - Person: Jimmy + Handle: '@bohops' +---