Detection rules › Splunk
Group Policy Editor Execution (Sysmon)
Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration. For example, mmc gpedit.msc, will open the Group Policy Editor application window. This use case detects gpedit.msc executions.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1218.014 System Binary Proxy Execution: MMC |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '32248.57377'
title: Group Policy Editor Execution
description: Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.
Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and
is used in several ways in either its GUI or in a command prompt. MMC can be used
to create, open, and save custom consoles that contain administrative tools created
by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems
locally or remotely. MMC can also be used to open Microsoft created .msc files to
manage system configuration. For example, mmc gpedit.msc, will open the Group Policy
Editor application window. This use case detects gpedit.msc executions.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
TERM(gpedit) ("mmc.exe" OR "Microsoft Management Console") | table _time, host,
user, process | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:mmc
technique_id:
- T1218.014
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1218/014/
- https://www.itechtics.com/enable-gpedit-windows-10-home/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") TERM(gpedit) ("mmc.exe" OR "Microsoft Management Console")
Stage 2: table
| table _time, host, user, process
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | TERM |
| 1 | gpedit |
| 1 | "mmc.exe" |
| 1 | "Microsoft Management Console" |