Ceplin Command Identifier

Identifier / Programs / Windows

mmc.exe

Using mmc command-line options, you can open a specific mmc console, open mmc in author mode, or specify that the 32-bit or 64-bit version of mmc is opened. Windows commands reference

LOLBAS Execute, Download 7 Sigma rules name it 4 ATT&CK techniques 3 documented commands 15 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How mmc.exe is abused

documented by LOLBAS

Execute T1218.014 System Binary Proxy Execution: MMC

-embedding

Download T1218.014 System Binary Proxy Execution: MMC

-embedding

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for mmc.exe.

3 documented commands

from LOLBAS, each read by the identifier

Execute T1218.014 System Binary Proxy Execution: MMC User privileges

Launch a 'backgrounded' MMC process and invoke a COM payload

mmc.exe -Embedding {PATH_ABSOLUTE:.msc}
Identify

UAC Bypass T1218.014 System Binary Proxy Execution: MMC Administrator privileges

Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC.

mmc.exe gpedit.msc
Identify

Download T1218.014 System Binary Proxy Execution: MMC User privileges

Download and save an executable to disk

mmc.exe -Embedding {PATH_ABSOLUTE:.msc}
Identify

None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for mmc.exe, by @bohops, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for mmc.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
highMMC20 Lateral Movement@2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea)
highMMC Executing Files with Reversed Extensions Using RTLO AbuseSwachchhanda Shrawan Poudel (Nextron Systems)
highPotentially Suspicious Event Viewer Child ProcessFlorian Roth (Nextron Systems)
highSuspicious Process ParentsFlorian Roth (Nextron Systems)
mediumWindows Default Domain GPO Modification via GPMETropChaud
lowPotential Executable Run Itself As Sacrificial Processfrack113
lowNew Process Created Via Taskmgr.EXEFlorian Roth (Nextron Systems)
T1021.003Remote Services: Distributed Component Object Model
T1036.002Masquerading: Right-to-Left Override
T1204.002User Execution: Malicious File
T1218.014System Binary Proxy Execution: MMC

Is it the real mmc.exe?

file version info and known copies
Installed inC:\Windows\SysWOW64\
C:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Management Console

15 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mmc.exe · signed by Microsoft Windows

3042d2612469b963432c4eb0a31aa67fb91c11b8b521c87505355ff5eeab5c93

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mmc.exe · signed by Microsoft Windows

ad93f7968cb25b46bbc0f95f0f825748f28dc839ce902aa2eab797282b5d212e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mmc.exe · signed by Microsoft Windows

095b584662c42b9dac72ff2505bceb86b80b9bb10a7875d0f0c17bec6fbff583

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mmc.exe · signed by Microsoft Windows

101b06fd8a344d594454bb1c4f9f2bc37680235504436512fb3abc3f20704547

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mmc.exe · signed by Microsoft Windows

35791f1dbd343a5a46a3a18100e2e85c1df83085053e07deae56d46132f982af

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mmc.exe · signed by Microsoft Windows

730fb58c545ae4d88654aff4431e64742405fce1289c52bc9c80397758d48be4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mmc.exe · signed by Microsoft Windows

895eef1eda5700a425934ae3782d4741dfefb7deafa53891bde490150187b98a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mmc.exe · signed by Microsoft Windows

b0ad764277fb78de24e0ef08e439a8e5690b11d91b8f772034d94315bf7b7e45

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mmc.exe · signed by Microsoft Windows

b219e237f43e29f7b92a835f5dc68e1f1579edb187002b5e30cb912a796e5a15

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mmc.exe · signed by Microsoft Windows

8a0dda9be75167fca4094ca23b2091e78a9e690ef3a584e815048ba9db24affd

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\mmc.exe · signed by Microsoft Windows

b82e5d5e2eebe6ee0afd1c233148bf5a46dc83a7358feb86c83e46a388d23b13

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\mmc.exe · signed by Microsoft Windows

38b20e000ee8a8675881ca126fa85daf9ce6a55eb7d990d8bb805d3afe48d342

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\mmc.exe · signed by Microsoft Windows

6bc24c0694afbc40256239f3c3a9ab1f99d76a7a00e683e53e079bb903149a50

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\mmc.exe · not signed

0cd33cc6d292d52b8c6e530158185502e47ecef0c47d92ac7a097ef1bbced0bc

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\mmc.exe · not signed

9563e5438c4925884538162d4b275387e59ee5ca3b89c9576d598b3b58253e4a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Options

1 in Windows commands reference
Show every option of mmc.exe
/aOpens a saved console in author mode.

Other programs abused for Execute

acccheckconsole.exe · addinutil.exe · adplus.exe · advpack.dll · agentexecutor.exe · appcert.exe · applauncher.exe · appvlp.exe · at.exe · atbroker.exe · bash.exe · bginfo.exe · bitsadmin.exe · cdb.exe · certoc.exe · change.exe