T1021.003 — Distributed Component Object Model

Tactic: Lateral Movement · Platforms: Windows

Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user. The Windows Component Object Model (COM) is a component of the native Windows application programming…

Sub-technique of Remote Services (T1021).

Sigma detection rules (1)

T1021.003 Remote Services: Distributed Component Object Model

title: "T1021.003 Remote Services: Distributed Component Object Model"
id: c1cc53b2-6c2e-41e6-a3e4-ae8a956ae249
description: 'Detection of DCOM-Based Remote Code Execution via Process Creation. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, ProcessName, RemoteHostList.'
references:
  - https://attack.mitre.org/techniques/T1021/003
author: Shahrukh Khan
date: 2026-01-30
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.003

logsource:
  category: process_creation
  product: windows

detection:
  selection_dcom_parent:
    ParentImage|endswith: '\svchost.exe'
    ParentCommandLine|contains: 'DcomLaunch'

  selection_suspicious_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'

  condition: selection_dcom_parent and selection_suspicious_child

falsepositives:
  - Legitimate DCOM-based applications and administrative or backup agents.

level: high

Related sub-techniques

Explore