MMC

Subtechnique · ATTACK:enterprise:T1218.014

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1218.014",
  "title": "MMC",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1218/014",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--ffbcfdb0-de22-4106-9ed3-fc23c8a01407",
  "external_id": "T1218.014",
  "domain": "enterprise",
  "created": "2021-09-28T01:36:41.638Z",
  "modified": "2026-05-12T15:12:00.726Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "abusing_com_reg",
      "url": "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/"
    },
    {
      "source_name": "mmc_vulns",
      "url": "https://research.checkpoint.com/2019/microsoft-management-console-mmc-vulnerabilities/"
    },
    {
      "source_name": "win_msc_files_overview",
      "url": "https://www.ghacks.net/2017/06/10/windows-msc-files-overview/"
    },
    {
      "source_name": "win_mmc",
      "url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mmc"
    },
    {
      "source_name": "win_wbadmin_delete_catalog",
      "url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-catalog"
    },
    {
      "source_name": "win_clsid_key",
      "url": "https://docs.microsoft.com/en-us/windows/win32/com/clsid-key-hklm"
    },
    {
      "source_name": "what_is_mmc",
      "url": "https://docs.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/what-is-microsoft-management-console"
    },
    {
      "source_name": "phobos_virustotal",
      "url": "https://www.virustotal.com/gui/file/0b4c743246478a6a8c9fa3ff8e04f297507c2f0ea5d61a1284fe65387d172f81/detection"
    }
  ]
}

Explicit source assertions (5)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.