Background

Microsoft Management Console (MMC) saved-console files (.msc) are trusted, signed-binary-launched content that most email and web filters treat as low risk. Since Office macros became harder to run, attackers have moved to alternative file types, and .msc is one of them.

The best-documented technique is GrimResource, published by Elastic Security Labs in June 2024. A crafted .msc references a vulnerable resource in apds.dll through its StringTable. The resource contains an old cross-site scripting flaw, which lets attacker-supplied JavaScript run inside mmc.exe. Paired with DotNetToJScript, this gives arbitrary code execution, and the sample Elastic analysed was used to deploy Cobalt Strike.

This is not a new CVE. It is a durable technique that still appears in red-team tooling and commodity loaders, and it is worth having coverage for. We could not find reporting that confirms current-year campaigns, so treat the detections below as technique coverage, not as a response to an active outbreak.

MITRE ATT&CK: T1218.014 (System Binary Proxy Execution: MMC), T1204.002 (User Execution: Malicious File).

What to Look For

The execution chain gives you several independent signals:

  1. A user opens an .msc from a non-standard location: Downloads, Temp, a mounted ISO/VHD, an archive extraction folder, or an email cache.
  2. mmc.exe loads apds.dll and jscript.dll / jscript9.dll or scrobj.dll, which is unusual for normal admin snap-ins.
  3. mmc.exe spawns a shell, scripting host, or LOLBin child such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
  4. The .msc file carries a Mark-of-the-Web (Zone.Identifier) or arrives inside an archive.

Sigma Rule: MMC Opening MSC From User-Writable Path

title: MMC Launched With MSC File From User-Writable Location
id: 6b0c3d52-8f4e-4a1b-9c27-3e5d7a1f2b90
status: experimental
description: Detects mmc.exe opening a .msc file from Downloads, Temp, or similar user-writable paths, as seen in GrimResource-style initial access.
references:
  - https://www.elastic.co/security-labs/grimresource
author: SOC Analyst Hub
date: 2026-10-20
tags:
  - attack.defense-evasion
  - attack.t1218.014
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\mmc.exe'
  selection_path:
    CommandLine|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\INetCache\'
  selection_ext:
    CommandLine|contains: '.msc'
  condition: all of selection_*
falsepositives:
  - Administrators running a custom console saved to Downloads
  - Vendor-supplied .msc files executed from a temporary install directory
level: high

Sigma Rule: MMC Spawning Script or Shell Children

title: Suspicious Child Process of mmc.exe
id: a4d91e07-2c68-4b3f-8e15-7f0b6c9d3a42
status: experimental
description: Detects mmc.exe spawning command interpreters or LOLBins, indicating script execution inside a crafted console file.
author: SOC Analyst Hub
date: 2026-10-20
tags:
  - attack.defense-evasion
  - attack.t1218.014
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\mmc.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection
falsepositives:
  - Some admin snap-ins launch cmd.exe or PowerShell (for example Exchange or custom management consoles)
level: high

KQL: Microsoft Defender for Endpoint

let UserPaths = dynamic(["\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\Users\\Public\\", "\\INetCache\\"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe"]);
union
(
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where FileName =~ "mmc.exe" and ProcessCommandLine has ".msc"
    | where ProcessCommandLine has_any (UserPaths)
    | extend Signal = "MSC from user-writable path"
),
(
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName =~ "mmc.exe"
    | where FileName in~ (SuspiciousChildren)
    | extend Signal = "Suspicious mmc.exe child"
)
| project Timestamp, DeviceName, AccountName, Signal, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by Timestamp desc

Tuning and False Positives

  • Baseline admin use. Build a 30-day list of .msc files launched per host group. Legitimate consoles (services.msc, eventvwr.msc, compmgmt.msc) live in C:\Windows\System32; anything else is the interesting set.
  • Exclude by path, not by name. Attackers pick names like sccm-updater.msc to blend in. Allowlist known-good paths and signed hashes from your admin tooling.
  • Scope the child-process rule. Exclude specific snap-in command lines used by your admins, and keep the rule at high severity for standard user workstations.
  • Correlate with delivery. Raise priority when the .msc was created by a browser, mail client, or archive tool within the last few minutes (DeviceFileEvents), or when the file carries a Zone.Identifier stream.
  • Pair with prevention. Block .msc at the mail gateway where practical, and consider an ASR or AppLocker policy restricting MMC from opening consoles outside System32 on non-admin endpoints.

Response

If either rule fires, isolate the host, collect the .msc file and its parent delivery artifact, and hunt for follow-on activity: new scheduled tasks, injected processes, and outbound beaconing from the process tree rooted at mmc.exe.

Sources