Load snap-ins to locally and remotely manage Windows systems

Paths:

C:\Windows\System32\mmc.exe
C:\Windows\SysWOW64\mmc.exe

Detection:

Execute

Launch a ‘backgrounded’ MMC process and invoke a COM payload

mmc.exe -Embedding c:\path\to\test.msc