T1021.003 Remote Services: Distributed Component Object Model

Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). MITRE ATT&CK

1 program on CmdID 5 Sigma rules T1021.003 on attack.mitre.org

Part of

MITRE ATT&CK

T1021Remote Services

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highHackTool - Potential Impacket Lateral Movement ActivityEcco, oscd.community, Jonhnathan Ribeiro, Tim Rauch · Windows

highMMC Spawning Windows ShellKarneades, Swisscom CSIRT · Windows

highMMC20 Lateral Movement@2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea) · Windows

highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows