EXPLORE

← Back to Explore

T1021.003

Distributed Component Object Model

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user. The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object c...

Windows

31

Detections

3

Sources

0

Threat Actors

BY SOURCE

13sigma10splunk_escu8elastic

PROCEDURES (22)

Remote4 detections

Auto-extracted: 4 detections for remote

Exfiltrat3 detections

Auto-extracted: 3 detections for exfiltrat

Child Process2 detections

Auto-extracted: 2 detections for child process

C22 detections

Auto-extracted: 2 detections for c2

Wmi2 detections

Auto-extracted: 2 detections for wmi

Registry2 detections

Auto-extracted: 2 detections for registry

C21 detections

Auto-extracted: 1 detections for c2

Process Creation Monitoring1 detections

Auto-extracted: 1 detections for process creation monitoring

Wmi1 detections

Auto-extracted: 1 detections for wmi

Powershell1 detections

Auto-extracted: 1 detections for powershell

Privilege1 detections

Auto-extracted: 1 detections for privilege

Dll Hijack1 detections

Auto-extracted: 1 detections for dll hijack

Dll Hijack1 detections

Auto-extracted: 1 detections for dll hijack

Credential1 detections

Auto-extracted: 1 detections for credential

Persist1 detections

Auto-extracted: 1 detections for persist

Privilege1 detections

Auto-extracted: 1 detections for privilege

Persist1 detections

Auto-extracted: 1 detections for persist

Parent Process1 detections

Auto-extracted: 1 detections for parent process

Powershell1 detections

Auto-extracted: 1 detections for powershell

Wmi1 detections

Auto-extracted: 1 detections for wmi

Dll Hijack1 detections

Auto-extracted: 1 detections for dll hijack

Credential1 detections

Auto-extracted: 1 detections for credential

DETECTIONS (31)

BaaUpdate.exe Suspicious DLL Load

DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

HackTool - Potential Impacket Lateral Movement Activity

Impacket Lateral Movement Commandline Parameters

Impacket Lateral Movement smbexec CommandLine Parameters

Impacket Lateral Movement WMIExec Commandline Parameters

Incoming DCOM Lateral Movement via MSHTA

Incoming DCOM Lateral Movement with MMC

Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows

Mmc LOLBAS Execution Process Spawn

MMC Spawning Windows Shell

MMC20 Lateral Movement

Outbound Scheduled Task Activity via PowerShell

Possible Lateral Movement PowerShell Spawn

Potential DCOM InternetExplorer.Application DLL Hijack

Potential DCOM InternetExplorer.Application DLL Hijack - Image Load

Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

Potential PowerShell HackTool Script by Function Names

Remote DCOM/WMI Lateral Movement

Remote Process Instantiation via DCOM and PowerShell

Remote Process Instantiation via DCOM and PowerShell Script Block

RPC (Remote Procedure Call) to the Internet

Suspicious BitLocker Access Agent Update Utility Execution

Suspicious Cmd Execution via WMI

Suspicious Non PowerShell WSMAN COM Provider

Suspicious Speech Runtime Binary Child Process

Suspicious WSMAN Provider Image Loads

Windows Excel Spawning Microsoft Project Application

Windows SpeechRuntime COM Hijacking DLL Load

Windows SpeechRuntime Suspicious Child Process

WMI Incoming Lateral Movement