Detection rules › Splunk
Suspicious Execution via Microsoft Common Console (Windows Event Log)
Microsoft Management Console (MMC) can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration. Threat actors may leverage malicious .msc files to gain full code execution via mmc.exe as observed in the GrimResource technique. This use case child processes created by mmc.exe that do not originate from common system directories or standard application paths. NOTE: Due to its extended logging capabilities for parent process behaviors and attributes, Sysmon is recommended for best rule fidelity.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1218.014 System Binary Proxy Execution: MMC |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '33701.59575'
title: Suspicious Execution via Microsoft Common Console
description: 'Microsoft Management Console (MMC) can be used to create, open, and
save custom consoles that contain administrative tools created by Microsoft, called
snap-ins. These snap-ins may be used to manage Windows systems locally or remotely.
MMC can also be used to open Microsoft created .msc files to manage system configuration.
Threat actors may leverage malicious .msc files to gain full code execution via
mmc.exe as observed in the GrimResource technique. This use case child processes
created by mmc.exe that do not originate from common system directories or standard
application paths. NOTE: Due to its extended logging capabilities for parent process
behaviors and attributes, Sysmon is recommended for best rule fidelity.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) (TERM(mmc) OR "mmc.exe") | where match(parent_process_name,
"(?i)mmc\.exe") and !match(process_path, "(?i):\x5c(Windows\x5c(System32|SysWOW64)\x5c(mmc|wermgr|WerFault)\.exe)|Program\sFiles(\s\(x86\))?\x5c.*\.exe|Windows\x5cSystem32\x5cspool\x5cdrivers\x5cx64\x5c3\x5c\S+\.exe")
and !match(process, "(?i):\x5c(Windows\x5c(System32|SysWOW64)\x5c(wermgr|WerFault)\.exe)")
| table _time, host, user, process, parent_process, parent_process_*, process_*
| bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id:
- T1218.014
data_category:
- Windows event logs
references:
- https://www.elastic.co/security-labs/grimresource
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) (TERM(mmc) OR "mmc.exe")
Stage 2: where
| where match(parent_process_name, "(?i)mmc\.exe") and !match(process_path, "(?i):\x5c(Windows\x5c(System32|SysWOW64)\x5c(mmc|wermgr|WerFault)\.exe)|Program\sFiles(\s\(x86\))?\x5c.*\.exe|Windows\x5cSystem32\x5cspool\x5cdrivers\x5cx64\x5c3\x5c\S+\.exe") and !match(process, "(?i):\x5c(Windows\x5c(System32|SysWOW64)\x5c(wermgr|WerFault)\.exe)")
Stage 3: table
| table _time, host, user, process, parent_process, parent_process_*, process_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
process | match | "(?i):\x5c(Windows\x5c(System32|SysWOW64)\x5c(wermgr|WerFault)\.exe)" |
process_path | match | "(?i):\x5c(Windows\x5c(System32|SysWOW64)\x5c(mmc|wermgr|WerFault)\.exe)|Program\sFiles(\s\(x86\))?\x5c.*\.exe|Windows\x5cSystem32\x5cspool\x5cdrivers\x5cx64\x5c3\x5c\S+\.exe" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
parent_process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | TERM |
| 1 | mmc |
| 1 | "mmc.exe" |