Detection rules › Splunk
Group Policy Editor Execution (Sysmon)
Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration. For example, mmc gpedit.msc, will open the Group Policy Editor application window. This use case detects gpedit.msc executions.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '32248.57377'
title: Group Policy Editor Execution
description: Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.
Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and
is used in several ways in either its GUI or in a command prompt. MMC can be used
to create, open, and save custom consoles that contain administrative tools created
by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems
locally or remotely. MMC can also be used to open Microsoft created .msc files to
manage system configuration. For example, mmc gpedit.msc, will open the Group Policy
Editor application window. This use case detects gpedit.msc executions.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
TERM(gpedit) ("mmc.exe" OR "Microsoft Management Console") | table _time, host,
user, process | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:mmc
technique_id:
- T1218.014
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1218/014/
- https://www.itechtics.com/enable-gpedit-windows-10-home/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") TERM(gpedit) ("mmc.exe" OR "Microsoft Management Console")
Stage 2: table
| table _time, host, user, process
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"1" |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>1<" |
| 1 | gpedit |
| 1 | "mmc.exe" |
| 1 | "Microsoft Management Console" |