ATT&CK technique
View on MITRE ATT&CK →
T1218.014
MMC
Stealth
12 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Possible Lateral Movement PowerShell Spawn | production | 2026-10-09 |
| elastic | UAC Bypass via Windows Firewall Snap-In Hijack | production | 2026-09-18 |
| elastic | Unusual Execution via Microsoft Common Console File | production | 2026-09-18 |
| elastic | Microsoft Management Console File from Unusual Path | production | 2026-09-18 |
| elastic | Incoming DCOM Lateral Movement with MMC | production | 2026-09-18 |
| splunk | Windows Mock Trusted Directory MSC File Creation | production | 2026-05-13 |
| splunk | Mmc LOLBAS Execution Process Spawn | production | 2026-05-13 |
| splunk | UAC Bypass MMC Load Unsigned Dll | production | 2026-05-13 |
| splunk | Windows Execution of Microsoft MSC File In Suspicious Path | production | 2026-05-13 |
| splunk | Windows GrimResource - MMC Process Accessing APDS DLL | production | 2026-05-13 |
| sigma | MMC Loading Script Engines DLLs | experimental | 2025-02-05 |
| sigma | MMC Executing Files with Reversed Extensions Using RTLO Abuse | experimental | 2025-02-05 |