MMC opening an .msc console staged in a user-writable path

Siemphony@siemphonyhighT1218.014unverified

Matches mmc.exe started with a command line that names an .msc console living under a user-writable or network location — the Users, AppData, Downloads, Desktop, ProgramData and Temp directories plus UNC paths that MITRE spells out in this analytic's SuspiciousMSCPathRegex knob. The Microsoft-supplied consoles are loaded from System32 by name, so a console path rooted in a profile or on a share is the staging step of the proxy-execution chain. All three tests are ANDed and each sits on a single field, which keeps the rule a flat conjunction that every backend can render. The rest of the chain the analytic describes — COM activation of a non-baseline CLSID, an unsigned DLL load into signed mmc.exe, then network activity — spans four log sources joined by a five to ten minute window, none of which Sigma can express, so this rule is the first link only. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0222, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\mmc.exe" and ProcessCommandLine contains ".msc") and (ProcessCommandLine contains "\\Users\\" or ProcessCommandLine contains "\\AppData\\" or ProcessCommandLine contains "\\Downloads\\" or ProcessCommandLine contains "\\Desktop\\" or ProcessCommandLine contains "\\ProgramData\\" or ProcessCommandLine contains "\\Temp\\" or ProcessCommandLine contains "\\\\"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\mmc.exe" AND CommandLine="*.msc*") AND (CommandLine="*\\Users\\*" OR CommandLine="*\\AppData\\*" OR CommandLine="*\\Downloads\\*" OR CommandLine="*\\Desktop\\*" OR CommandLine="*\\ProgramData\\*" OR CommandLine="*\\Temp\\*" OR CommandLine="*\\\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\mmc.exe" AND TO_LOWER(process.command_line) LIKE "*.msc*") AND (TO_LOWER(process.command_line) LIKE "*\\\\users\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\appdata\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\downloads\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\desktop\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\programdata\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\temp\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\mmc\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)\.msc</field>    <field name="CommandLine" type="pcre2">(?i)(\\Users\\|\\AppData\\|\\Downloads\\|\\Desktop\\|\\ProgramData\\|\\Temp\\|\\\\)</field>    <description>MMC opening an .msc console staged in a user-writable path</description>    <mitre>      <id>T1218.014</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1c45415b-271b-4b4f-a70b-ab5847a4ffaf

ATT&CKT1218.014

T1218.014MMC

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

mmc.exe opening an .msc console that lives somewhere a user can write. Microsoft's own consoles — compmgmt.msc, services.msc, gpedit.msc — are loaded from System32 by name. A console rooted in a profile folder, in Downloads, or on a share is a staged file, and MMC is a signed Microsoft binary that will happily proxy execution for it. MITRE's AN0622 describes four links: the suspicious mmc.exe invocation, COM activation of a non-baseline CLSID, an unsigned DLL loading into signed mmc.exe, and optional network activity — joined across Sysmon 1, 7, 12/13/14 and 3/22 by a five-to-ten-minute window. Sigma joins nothing, so only the first link is authored. Everything that would make this high-fidelity is absent.

02 · Telemetry you need

Sysmon EventID 1, or Security 4688 with Audit Process Creation and
For the links the rule drops: Sysmon EventID 7 (module load, for the

03 · How the logic works

Count the backslashes in that last term. In Sigma, \\ is one literal backslash, so '\\\\' is two — a UNC prefix. Written as '\\' the term would mean "contains a backslash", which every Windows path satisfies, and the whole selection would be permanently true while looking tight. This is the most common silent failure in the corpus and it is worth internalising here. Where the attribution has to be precise. MITRE's SuspiciousMSCPathRegex knob reads: (Users, AppData, Downloads, Desktop, UNC). Five terms. The rule lists seven — \ProgramData\ and \Temp\ are the author's additions, and the rule's own description attributes all of them to MITRE. That matters because \ProgramData\ is precisely the term that generates false-positive entry 2. When you read a rule, check whether the knob named the values or only the knob. Three tests, operationally two. Once Image|endswith: '\mmc.exe' has matched, CommandLine|contains: '.msc' adds almost nothing — nearly every mmc.exe launch names a console. It is a cheap guard, not a third discriminator. The UNC term is not anchored to the console path. It is a bare contains against the whole command line, and the documented remote-management syntax puts two backslashes there on every routine use: mmc compmgmt.msc /computer=\\SERVER01. Same for devmgmt.msc, eventvwr.msc and services.msc. The Splunk render is CommandLine="*\\*" against a literal double backslash, so it fires on the /computer= argument, not on a staged console. In any environment with a helpdesk this is the top alert source, and the rule's false-positive block describes the mechanism generically without ever naming the case. And a relative path walks straight past it. Set the working directory to the staging folder and run mmc evil.msc: no directory appears in the command line at all, all seven path terms miss, and the proxy execution is unchanged. Staging in C:\PerfLogs\, C:\Windows\Tasks\ or the drive root misses for the same reason — the list enumerates a set that has no boundary.

04 · Common false positives

Remote Computer Management and Device Manager driven the documented way, via
Vendor management suites that install their own snap-in under ProgramData,
Roaming or redirected profiles, where an ordinary Microsoft console is
Operations teams that genuinely keep custom consoles on a file share.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0222 and never executed against a log line. level: high is asserted, not measured, and the review argues it is too high.
tier_2: means running it over history, confirming that remote-management sessions dominate, and either killing the UNC term or filtering /computer=.
tier_3: means restoring the chain: this process creation joined to the Sysmon 7 unsigned-module load into mmc.exe inside MITRE's TimeWindow. That correlation, not the path list, is what separates a staged console from a helpdesk session.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Drop or anchor the UNC term first. Either remove it and rely on the directory
Invert the logic: alert on an .msc path that does not resolve under
MITRE's AllowedMSCList knob is the intended suppression — enumerate the
MITRE's ParentProcessAllowList knob is the highest-value addition here:
AllowedCLSIDs and SignedToUnsignedTransition need Sysmon 12/13/14 and 7.

Declared by the author

Custom administrative consoles that an operations team genuinely keeps in a profile folder or on a file share and opens by UNC path. MITRE's AllowedMSCList knob exists precisely for this — the sanctioned console names and locations have to be enumerated per environment before the rule is quiet.
Software vendors and management suites that ship their own .msc snap-in and install it under ProgramData rather than System32, so every routine launch of the product console matches the staged-path test.
Roaming or redirected profiles, where an ordinary Microsoft console is reached through a UNC home directory and the path test fires on the redirection rather than on anything the operator did.
The double-backslash term also matches a command line that merely contains an escaped path or a UNC reference elsewhere in its arguments, not only in the console path — the SuspiciousMSCPathRegex knob is where a site tightens that into a real path anchor.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.014, evaluated against their process_creation events.

Share this rule

/u/siemphony/1c45415b-271b-4b4f-a70b-ab5847a4ffaf

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

MMC opening an .msc console staged in a user-writable path

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it