Mmc.exe

Load snap-ins to locally and remotely manage Windows systems

Download

Download file from Internet

mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

Download and save an executable to disk — MITRE: T1218.014 — Privileges: User

Execute

Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry

mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

Launch a 'backgrounded' MMC process and invoke a COM payload — MITRE: T1218.014 — Privileges: User

UAC Bypass

Modify HKCU\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.

mmc.exe gpedit.msc

Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC. — MITRE: T1218.014 — Privileges: Administrator