T1021.003sub-technique of T1021 Remote Services
Distributed Component Object Model
Windowsnothing on this site yetT1021.003 on attack.mitre.org
Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user. The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Multi-Event Behavioral Detection for DCOM-Based Remote Code Execution
- A remote DCOM invocation by a privileged account using RPC (port 135), followed by abnormal process instantiation or module loading on the remote system indicative of code execution.
what reduces it
- M1030 Network Segmentation. Enable Windows firewall, which prevents DCOM instantiation by default.
- M1026 Privileged Account Management. Modify Registry settings (directly or using Dcomcnfg.exe) in `HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{{AppID_GUID}}` associated with the process-wide security of individual COM applications. Modify Registry settings (directly or using Dcomcnfg.exe) in `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole` associated with system-wide security defaults for all COM applications that do not set their own process-wide security.
- M1048 Application Isolation and Sandboxing. Ensure all COM alerts and Protected View are enabled.
- M1042 Disable or Remove Feature or Program. Consider disabling DCOM through Dcomcnfg.exe.