Skip to content

Hide Navigation Hide TOC

Remote DCOM/WMI Lateral Movement (68050b10-e477-4377-a99b-3721b422d6ef)

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

Cluster A Galaxy A Cluster B Galaxy B Level
Distributed Component Object Model - T1021.003 (68a0c5ed-bee2-4513-830d-5b0d650139bd) Attack Pattern Remote DCOM/WMI Lateral Movement (68050b10-e477-4377-a99b-3721b422d6ef) Sigma-Rules 1
Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) Attack Pattern Remote DCOM/WMI Lateral Movement (68050b10-e477-4377-a99b-3721b422d6ef) Sigma-Rules 1
Distributed Component Object Model - T1021.003 (68a0c5ed-bee2-4513-830d-5b0d650139bd) Attack Pattern Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba) Attack Pattern 2