.msc Executed from Unusual Location (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Threat actors may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration. This use case detects mmc.exe executions referencing .msc files outside of C:\Windows\system32 or C:\Windows\SysWOW64.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.014` System Binary Proxy Execution: MMC

References

https://www.itechtics.com/enable-gpedit-windows-10-home/

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '32363.57558'
title: .msc Executed from Unusual Location
description: 'Threat actors may abuse mmc.exe to proxy execution of malicious .msc
  files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft
  and is used in several ways in either its GUI or in a command prompt. MMC can be
  used to create, open, and save custom consoles that contain administrative tools
  created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows
  systems locally or remotely. MMC can also be used to open Microsoft created .msc
  files to manage system configuration. This use case detects mmc.exe executions referencing
  .msc files outside of C:\Windows\system32 or C:\Windows\SysWOW64. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("mmc.exe" OR "Microsoft Management Console") ".msc" | regex process="(?i)\.msc"|
  regex process!="(?i)C:\x5cWindows\x5c(system32|syswow64)\x5c\w+\.msc" | table _time,
  host, user, process | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:mmc
technique_id:
- T1218.014
data_category:
- Windows Sysmon
references:
- https://www.itechtics.com/enable-gpedit-windows-10-home/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") ("mmc.exe" OR "Microsoft Management Console") ".msc"

Stage 2: `regex`

| regex process="(?i)\.msc"

Stage 3: `regex`

| regex process!="(?i)C:\x5cWindows\x5c(system32|syswow64)\x5c\w+\.msc"

Stage 4: `table`

| table _time, host, user, process

Stage 5: `bucket`

| bin span=1s

Stage 6: `stats`

| stats values(*) as * by _time, host

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`process`	regex_match	`"(?i)C:\x5cWindows\x5c(system32\|syswow64)\x5c\w+.msc"`	`excludes:process`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process`	regex_match	`"(?i).msc"` corpus 2 (splunk 2)	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>1<"`
1	`"mmc.exe"`
1	`"Microsoft Management Console"`
1	`".msc"`