MMC Spawning Windows Shell

Title: MMC Spawning Windows Shell
Status: test
Description:Detects a Windows command line executable started from MMC
References:
  -https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
Author: Karneades, Swisscom CSIRT
Date: 2019-08-05
modified:2022-07-14
Tags:

• -'attack.lateral-movement'
• -'attack.t1021.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection1:
    ParentImage|endswith: '\mmc.exe'
  selection2:
    - Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\reg.exe'
      - '\regsvr32.exe'
Image|contains:'\BITSADMIN'   condition:all of selection*
Falsepositives:
Level: high