T1021.003Lateral Movement
Distributed Component Object Model
Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user. The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
13 Sigma rules tagged T1021.003Distributed Component Object ModelT1021.00313 general rules
- Potential DCOM InternetExplorer.Application DLL Hijackcriticaltest
- Potential DCOM InternetExplorer.Application DLL Hijack - Image Loadcriticaltest
- HackTool - Potential Impacket Lateral Movement Activityhighstable
- DCOM InternetExplorer.Application Iertutil DLL Hijack - Securityhightest
- MMC Spawning Windows Shellhightest
- MMC20 Lateral Movementhightest
- Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApphightest
- Remote DCOM/WMI Lateral Movementhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Distributed Component Object Model
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.