Create Mmc.yml

yml/OSBinaries/Mmc.yml

@@ -0,0 +1,28 @@
+---
+Name: Mmc.exe
+Description: 
+Author: '@bohops'
+Created: '2018-12-04'
+Commands:
+  - Command: mmc.exe -Embedding c:\path\to\test.msc
+    Description: Load snap-ins to locally and remotely manage Windows systems 
+    Usecase: Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry.
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows 10 (and possibly earlier versions)
+
+Full Path:
+  - Path: C:\Windows\System32\mmc.exe
+  - Path: C:\Windows\SysWOW64\mmc.exe
+Code Sample: 
+- Code:
+Detection:
+ - IOC: 
+Resources:
+  - Link: https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
+Acknowledgement:
+  - Person: Jimmy
+    Handle: '@bohops'
+---