Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1021.003

Distributed Component Object Model

Lateral Movement 31 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
splunk Impacket Lateral Movement WMIExec Commandline Parameters production 2026-10-09
splunk Possible Lateral Movement PowerShell Spawn production 2026-10-09
elastic RPC (Remote Procedure Call) to the Internet production 2026-09-21
elastic Potential PowerShell HackTool Script by Function Names production 2026-09-18
elastic WMI Incoming Lateral Movement production 2026-09-18
elastic Outbound Scheduled Task Activity via PowerShell production 2026-09-18
elastic Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows production 2026-09-18
elastic Incoming DCOM Lateral Movement with MMC production 2026-09-18
elastic Incoming DCOM Lateral Movement via MSHTA production 2026-09-18
elastic Suspicious Cmd Execution via WMI production 2026-09-18
sigma Suspicious WSMAN Provider Image Loads test 2026-07-28
splunk Mmc LOLBAS Execution Process Spawn production 2026-05-13
splunk Impacket Lateral Movement Commandline Parameters production 2026-05-13
splunk Impacket Lateral Movement smbexec CommandLine Parameters production 2026-05-13
splunk Remote Process Instantiation via DCOM and PowerShell production 2026-05-13
splunk Remote Process Instantiation via DCOM and PowerShell Script Block production 2026-05-13
splunk Windows Excel Spawning Microsoft Project Application production 2026-05-13
splunk Windows SpeechRuntime COM Hijacking DLL Load production 2026-05-13
splunk Windows SpeechRuntime Suspicious Child Process production 2026-05-13
sigma Suspicious Speech Runtime Binary Child Process experimental 2025-10-23
sigma Suspicious Non PowerShell WSMAN COM Provider test 2025-10-22
sigma BaaUpdate.exe Suspicious DLL Load experimental 2025-10-18
sigma Suspicious BitLocker Access Agent Update Utility Execution experimental 2025-10-18
sigma Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp test 2023-11-13
sigma HackTool - Potential Impacket Lateral Movement Activity stable 2023-02-21
sigma Potential DCOM InternetExplorer.Application DLL Hijack - Image Load test 2022-12-18
sigma Potential DCOM InternetExplorer.Application DLL Hijack test 2022-12-18
sigma DCOM InternetExplorer.Application Iertutil DLL Hijack - Security test 2022-11-26
sigma MMC Spawning Windows Shell test 2022-07-14
sigma Remote DCOM/WMI Lateral Movement test 2022-01-01
sigma MMC20 Lateral Movement test 2021-11-27