tfMITRE ATT&CK sub-technique

Distributed Component Object Model T1021.003

Tactic: Lateral Movement
Platform: Windows
Version: 1.3
Created: 11 February 2020
Last modified: 24 October 2025

Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 12%

Detection rules88th percentile · 88% of ATT&CK techniques have this many detection rules written or fewer.

Distributed Component Object Model MITRE reference T1021.003

57th pctamong all ATT&CK techniques for number of tools

3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

SILENTTRINITYS0692 ↗

Can use System namespace methods to execute lateral movement using DCOM.1

created 2022-03-23TOOL

EmpireS0363 ↗

Can utilize Invoke-DCOM to leverage remote COM execution for lateral movement.1

created 2019-03-11TOOLcarried by 17 groups

Cobalt StrikeS0154 ↗

Can deliver Beacon payloads for lateral movement by leveraging remote COM execution.1

created 2017-12-14MALWAREcarried by 30 groups

All 3 software entries for this technique

Offense vs defense T1021.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 13Splunk ESCU (cumulative) · 10

first rule: 2019 Q3

Distributed Component Object Model detection strategy DET0285

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Multi-Event Behavioral Detection for DCOM-Based Remote Code Execution

Enterprise

1 platform

AN0791 · Windows

A remote DCOM invocation by a privileged account using RPC (port 135), followed by abnormal process instantiation or module loading on the remote system indicative of code execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlate RPC activity with remote process creation within a configurable time window (e.g., 300s)
UserContext	Identify rare or first-time DCOM invocations by specific accounts
ProcessName	List of suspicious executables commonly abused via DCOM (e.g., excel.exe, wmiprvse.exe)
RemoteHostList	Known set of systems that should or should not be invoking DCOM activity

1 analytic

Microsoft Windows uses its implementation of Distributed Computing Environment/Remote Procedure Call (DCE/RPC), which it calls Microsoft RPC, to call certain APIs remotely.

TypesTTP, Situational AwarenessCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-RTA	RPC Traffic Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	start	dest_port
flow	start	src_port

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Traffic to the RPC Endpoint Mapper will always have the destination port of 135. Assuming success, RPC traffic will continue to the endpoint. The endpoint and the client both bind to dynamically assigned ports (on Windows, this is typically greater than 49152). The traffic between the client and endpoint can be detected by looking at traffic to 135 followed by traffic where the source and destination ports are at least 49152.

flows = search Flow:Start
rpc_mapper = filter flows where (dest_port == 135)
rpc_endpoint = filter flows where (dest_port >= 49152 and src_port >= 49152)
rpc = join rpc_mapper, rpc_endpoint where (
 (rpc_mapper.time < rpc_endpoint.time < rpc_mapper.time + 2 seconds) and
 (rpc_mapper.src_ip == rpc_endpoint.src_ip and rpc_mapper.dest_ip == rpc_endpoint.dest_ip)
)
output rpc

Application Isolation and SandboxingM1048

Ensure all COM alerts and Protected View are enabled.

Disable or Remove Feature or ProgramM1042

Consider disabling DCOM through Dcomcnfg.exe.

Network SegmentationM1030

Enable Windows firewall, which prevents DCOM instantiation by default.

Privileged Account ManagementM1026

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{{AppID_GUID}} associated with the process-wide security of individual COM applications. Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole associated with system-wide security defaults for all COM applications that do not set their own process-wide security.

Tests2ExecutorsPowerShell 2Need elevation0 of 2Have prerequisites1Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

PowerShell Lateral Movement using MMC20

windows

PowerShell

—

Powershell lateral movement using the mmc20 application com object. Reference: https://blog.cobaltstrike.com/2017/01/24/scripting-matt-nelsons-mmc20-application-lateral-movement-technique/ Upon successful execution, cmd will spawn calc.exe on a remote computer.

Input arguments

Name	Type	Default	Description
computer_name	string	localhost	Name of Computer

Attack command

[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Document.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe", $null, $null, "7")

GUID2d4f7a11-eea6-4507-8ffc-40f92b1a5617

PowerShell Lateral Movement Using Excel Application Object

windows

PowerShell

—

Yes

Powershell lateral movement using the Excel COM objects. Reference: https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922 Upon successful execution, cmd will spawn calc.exe on a remote computer.

Input arguments

Name	Type	Default	Description
user	string	admin	Name of user
computer_name	string	localhost	Hostname or IP

Attack command

copy c:\windows\system32\calc.exe 'C:\users\#{user}\AppData\local\Microsoft\WindowsApps\foxprow.exe'
$com = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application","#{computer_name}"))
$com.ActivateMicrosoftApp("5")

Cleanup command

Remove-Item 'C:\users\#{user}\AppData\local\Microsoft\WindowsApps\foxprow.exe'

Prerequisite

Microsoft Excel must be installed

Check

try {
  New-Object -COMObject "Excel.Application" | Out-Null
  Stop-Process -Name "Excel"
  exit 0
} catch { exit 1 }

Satisfy

Write-Host "You will need to install Microsoft Excel manually to meet this requirement"

GUIDefb89861-1e4d-42f5-9d4f-445e32ded343

Tests from Atomic Red Team (MIT licence) · technique definition

Distributed Component Object Model detections T1021.003

23 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 12%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs