Load snap-ins to locally and remotely manage Windows systems
mmc.exe gpedit.msc
Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC.
Modify HKCU\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.
C:\Windows\System32\mmc.exe, C:\Windows\SysWOW64\mmc.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml
Jimmy (@bohops), clem (@clavoillotte)