Skip to content
Threat Feed
Subscribe

Tag

Dcom

5 briefs RSS
high advisory

Incoming DCOM Lateral Movement with MMC

Detection of Distributed Component Object Model (DCOM) abuse to execute commands remotely via the MMC20 Application COM object, potentially indicating lateral movement.

Elastic Defend +1 lateral-movement dcom windows
2r 1t
high advisory

Incoming DCOM Lateral Movement via MSHTA

Detection of Distributed Component Object Model (DCOM) abuse to execute commands from a remote host via the HTA Application COM Object, potentially indicating lateral movement.

Windows lateral-movement dcom mshta
2r 1t
medium advisory

Suspicious Explorer Child Process via DCOM

A suspicious Windows Explorer child process is detected, indicating potential exploitation of explorer.exe to launch malicious scripts or executables from a trusted parent process via DCOM.

Windows explorer.exe dcom initial-access defense-evasion execution
3r 9t
medium advisory

DCOM Lateral Movement via ShellWindows/ShellBrowserWindow

This analytic identifies the use of Distributed Component Object Model (DCOM) to execute commands on a remote host, specifically when launched via ShellBrowserWindow or ShellWindows Application COM objects, indicating potential lateral movement by an attacker.

Windows lateral-movement dcom
2r 2t
medium advisory

Suspicious Explorer Child Process via DCOM

Adversaries abuse the trusted status of explorer.exe to launch malicious scripts or executables, often using DCOM to start processes like PowerShell or cmd.exe, achieving initial access, defense evasion, and execution.

Microsoft Defender XDR +2 initial-access defense-evasion execution explorer.exe dcom
2r 9t