Skip to content

Hide Navigation Hide TOC

MMC20 Lateral Movement (f1f3bf22-deb2-418d-8cce-e1a45e46a5bd)

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

Cluster A Galaxy A Cluster B Galaxy B Level
MMC20 Lateral Movement (f1f3bf22-deb2-418d-8cce-e1a45e46a5bd) Sigma-Rules Distributed Component Object Model - T1021.003 (68a0c5ed-bee2-4513-830d-5b0d650139bd) Attack Pattern 1
Distributed Component Object Model - T1021.003 (68a0c5ed-bee2-4513-830d-5b0d650139bd) Attack Pattern Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba) Attack Pattern 2