Brute Ratel C4 MMC Impersonation
Detects execution of mmc.exe from unusual file paths, specifically outside of standard Windows System32 or SysWOW64 directories. This behavior can indicate an attempt to impersonate legitimate system processes, potentially by malware like Brute Ratel C4.
Microsoft Sentinel (KQL)
