domains / families / security / hunting-for-dcom-lateral-movement

hunting-for-dcom-lateral-movement

separate

'Hunt for DCOM-based lateral movement (MITRE ATT&CK T1021.003) by detecting

When to use

• Proactively hunting for lateral movement in Active Directory environments where DCOM is enabled
• Investigating alerts for suspicious mmc.exe, dllhost.exe, or explorer.exe child process creation on servers
• Building detection rules for MITRE ATT&CK T1021.003 (Remote Services: Distributed Component Object Model)
• Correlating Sysmon Event ID 1 (Process Create) and Event ID 3 (Network Connection) to trace DCOM-based command execution chains
• Auditing DCOM exposure across the domain to reduce lateral movement attack surface
• During purple team exercises validating detection coverage for DCOM-based techniques

When not to use

• Replacement for EDR-based lateral movement detection
• Use without Sysmon or equivalent process telemetry deployed on endpoints
• Use in isolation without correlating network-level and host-level indicators

Skill page

Source