attack.t1218.014 | Detection.FYI

MMC Executing Files with Reversed Extensions Using RTLO Abuse

Oct 1, 2025 · attack.execution attack.t1204.002 attack.defense-evasion attack.t1218.014 attack.t1036.002 ·
Share on:

Detects malicious behavior where the MMC utility (mmc.exe) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.

Read More
MMC Loading Script Engines DLLs

Oct 1, 2025 · attack.execution attack.defense-evasion attack.t1059.005 attack.t1218.014 ·
Share on:

Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.

Read More