Esc

MMC - T1218.014

(ATT&CK® Technique)

Definition

Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1218014["MMC"] --> |executes| Command["Command"]; class T1218014 OffensiveTechniqueNode;
        class Command ArtifactNode; click Command href "/dao/artifact/d3f:Command";
        click T1218014 href "/offensive-technique/attack/T1218.014/"; click Command href "/dao/artifact/d3f:Command"; T1218014["MMC"] --> |may-add| Software["Software"]; class T1218014 OffensiveTechniqueNode;
        class Software ArtifactNode; click Software href "/dao/artifact/d3f:Software";
        click T1218014 href "/offensive-technique/attack/T1218.014/"; click Software href "/dao/artifact/d3f:Software"; T1218014["MMC"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1218014 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";
        click T1218014 href "/offensive-technique/attack/T1218.014/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";                                        RestoreDatabase["Restore Database"] -->
          | restores | SystemConfigurationDatabase["System Configuration Database"];

          RestoreDatabase["Restore Database"] -.->
            | may-restore | T1218014["MMC"] ;
          class RestoreDatabase DefensiveTechniqueNode;
          class SystemConfigurationDatabase ArtifactNode;
          click RestoreDatabase href "/technique/d3f:RestoreDatabase"; RestoreSoftware["Restore Software"] -->
          | restores | Software["Software"];

          RestoreSoftware["Restore Software"] -.->
            | may-restore | T1218014["MMC"] ;
          class RestoreSoftware DefensiveTechniqueNode;
          class Software ArtifactNode;
          click RestoreSoftware href "/technique/d3f:RestoreSoftware";                                                    SoftwareUpdate["Software Update"] -->
          | updates | Software["Software"];

          SoftwareUpdate["Software Update"] -.->
            | may-harden | T1218014["MMC"] ;
          class SoftwareUpdate DefensiveTechniqueNode;
          class Software ArtifactNode;
          click SoftwareUpdate href "/technique/d3f:SoftwareUpdate"; SystemConfigurationPermissions["System Configuration Permissions"] -->
          | restricts | SystemConfigurationDatabase["System Configuration Database"];

          SystemConfigurationPermissions["System Configuration Permissions"] -.->
            | may-harden | T1218014["MMC"] ;
          class SystemConfigurationPermissions DefensiveTechniqueNode;
          class SystemConfigurationDatabase ArtifactNode;
          click SystemConfigurationPermissions href "/technique/d3f:SystemConfigurationPermissions";

json