skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-dcom-lateral-movement

Detect DCOM lateral movement using Sysmon telemetry, SIEM rules, and network traffic correlation.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#lateral movement#sysmon#dcom#sigma rules#siem detection#t1021.003
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-dcom-lateral-movement
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-dcom-lateral-movement
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-dcom-lateral-movement
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-dcom-lateral-movement

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

DCOM-based lateral movement (MITRE ATT&CK T1021.003) lets attackers execute commands on remote Windows hosts without dropping files, evading many traditional detections. This Skill provides a complete hunting methodology to identify abuse of MMC20.Application, ShellWindows, and ShellBrowserWindow COM objects before attackers move deeper into your network.

Core Features & Use Cases

  • Sysmon Detection Configuration: Ready-to-deploy Sysmon rules capturing process creation (EID 1), network connections (EID 3), and image loads (EID 7) specific to DCOM abuse patterns.
  • Multi-Platform SIEM Rules: Sigma rules, Splunk SPL queries, and Microsoft Sentinel KQL queries that correlate RPC port 135 connections with suspicious parent-child process chains.
  • Network-Level Detection: Zeek scripts for monitoring DCE-RPC traffic and RPC endpoint mapper anomalies across internal hosts.
  • Use Case: A SOC analyst investigating suspicious mmc.exe spawning cmd.exe on a file server can follow the workflow to correlate Sysmon events with network logons (Event 4624 Type 3), trace the attack back to the source host, and validate detection coverage using Atomic Red Team T1021.003 tests.

Quick Start

Ask the AI to hunt for DCOM lateral movement on your Windows endpoints by correlating Sysmon process creation events with inbound RPC connections on port 135.

Frequently Asked Questions about hunting-for-dcom-lateral-movement

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect DCOM lateral movement with Sysmon?▼

Configure Sysmon to capture Event ID 1 (Process Create) for mmc.exe, dllhost.exe, and explorer.exe spawning cmd.exe or powershell.exe, plus Event ID 3 (Network Connection) on destination port 135. Correlate an inbound RPC connection with a subsequent suspicious process creation within 60 seconds.

What is the difference between MMC20 and ShellWindows DCOM detection?▼

MMC20.Application spawns mmc.exe as a child of svchost.exe (DcomLaunch), creating a visible new process. ShellWindows and ShellBrowserWindow execute commands through an existing explorer.exe process without creating a new COM server process, so detection requires monitoring explorer.exe child processes on hosts with no interactive logon.

Which SIEM platforms support these DCOM detection rules?▼

The Skill provides vendor-agnostic Sigma rules plus native queries for Splunk (SPL) and Microsoft Sentinel (KQL). Sigma rules can also be converted for Elastic and other SIEM platforms using standard Sigma backends.

How do I validate that DCOM detection rules actually fire?▼

Run Impacket dcomexec.py with the MMC20 or ShellWindows object, or execute Atomic Red Team T1021.003 tests in a lab. Confirm Sysmon EID 1 shows the expected parent-child chain and EID 3 shows inbound TCP 135 followed by an ephemeral port connection within about 60 seconds.

What are common false positives in DCOM lateral movement detection?▼

SCCM and other management tools legitimately use DCOM for remote administration, and admins may launch cmd.exe from Explorer context menus. Tune by baselining source subnets, accounts, and checking for a preceding Type 3 NTLM or Kerberos logon (Event 4624).

When should I not rely on this DCOM hunting approach?▼

Do not use it as a replacement for EDR-based lateral movement detection, or without Sysmon or equivalent process telemetry deployed on endpoints. It also requires correlating network-level and host-level indicators rather than relying on a single data source.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-webshell-activity

Detect webshell deployments by analyzing process creation, network, and web access logs.

Official
Advanced
Yamato-SecurityYamato-Security
26

investigate_jp

Analyze Hayabusa CSV logs to generate Japanese intrusion timelines and incident reports.

Official
Advanced
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced
Prohao42Prohao42
120

windows-lateral-movement

Execute lateral movement techniques on Windows systems for penetration testing.

Community
Advanced