Techniques › T1021.003 › AN0791
AN0791 Analytic 0791
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A remote DCOM invocation by a privileged account using RPC (port 135), followed by abnormal process instantiation or module loading on the remote system indicative of code execution.</p>
- Detects
- T1021.003 Distributed Component Object Model
- Part of
- DET0285 Multi-Event Behavioral Detection for DCOM-Based Remote Code Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4624, 4648 | DC0067 Logon Session Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlate RPC activity with remote process creation within a configurable time window (e.g., 300s) |
UserContext | Identify rare or first-time DCOM invocations by specific accounts |
ProcessName | List of suspicious executables commonly abused via DCOM (e.g., excel.exe, wmiprvse.exe) |
RemoteHostList | Known set of systems that should or should not be invoking DCOM activity |