| Item |
Value |
| ID |
DET0285 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1021.003 (Distributed Component Object Model)
Analytics
Windows
AN0791
A remote DCOM invocation by a privileged account using RPC (port 135), followed by abnormal process instantiation or module loading on the remote system indicative of code execution.
Log Sources
Mutable Elements
| Field |
Description |
| TimeWindow |
Correlate RPC activity with remote process creation within a configurable time window (e.g., 300s) |
| UserContext |
Identify rare or first-time DCOM invocations by specific accounts |
| ProcessName |
List of suspicious executables commonly abused via DCOM (e.g., excel.exe, wmiprvse.exe) |
| RemoteHostList |
Known set of systems that should or should not be invoking DCOM activity |