Load snap-ins to locally and remotely manage Windows systems
mmc.exe -Embedding c:\path\to\test.msc
Launch a 'backgrounded' MMC process and invoke a COM payload
Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry
C:\Windows\System32\mmc.exe, C:\Windows\SysWOW64\mmc.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml
Jimmy (@bohops), clem (@clavoillotte)