Lateral Movement via DCOM

Status: available
Severity: medium
Time window: 1h
Group by: CommandLine, Computer, Description, EventID, Image, ParentCommandLine, ParentImage, ParentProcessGuid, ParentUser, ProcessGuid, User
Source: github.com/Azure/Azure-Sentinel

This query detects a fairly uncommon attack technique using the Windows Distributed Component Object Model (DCOM) to make a remote execution call to another computer system and gain lateral movement throughout the network. Ref: http://thenegative.zone/incident response/2017/02/04/MMC20.Application-Lateral-Movement-Analysis.html

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.003` Remote Services: Distributed Component Object Model

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: 50cbf34a-4cdd-45d7-b3f5-8b53a1d0d14f
name: Lateral Movement via DCOM
description: | 
  'This query detects a fairly uncommon attack technique using the Windows Distributed Component Object Model (DCOM) to make a remote execution call to another computer system and gain lateral movement throughout the network.
  Ref: http://thenegative.zone/incident%20response/2017/02/04/MMC20.Application-Lateral-Movement-Analysis.html'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
relevantTechniques:
  - T1021.003
query: |
  Event
  | where EventLog =~ "Microsoft-Windows-Sysmon/Operational" and EventID==1
  | parse EventData with * 'CommandLine">' CommandLine "<" * 'ParentCommandLine">' ParentCommandLine "<" *
  | where ParentCommandLine =~ "C:\\Windows\\System32\\svchost.exe -k DcomLaunch" and CommandLine =~ "C:\\Windows\\System32\\mmc.exe -Embedding"
  | parse EventData with * 'ProcessGuid">' ProcessGuid "<" * 'Image">' Image "<" * 'Description">' Description "<" * 'CurrentDirectory">' CurrentDirectory "<" * 'User">' User "<" * 'LogonGuid">' LogonGuid "<" * 'ParentProcessGuid">' ParentProcessGuid "<" * 'ParentImage">' ParentImage "<" * 'ParentCommandLine">' ParentCommandLine "<" * 'ParentUser">' ParentUser "<" *
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, User, ParentImage, ParentProcessGuid, ParentCommandLine, ParentUser, Image, ProcessGuid, CommandLine, Description
  | extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')
entityMappings:
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: CommandLine
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: User
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

Event

Stage 2: `where`

| where EventLog =~ "Microsoft-Windows-Sysmon/Operational" and EventID==1

Stage 3: `parse`

| parse EventData with * 'CommandLine">' CommandLine "<" * 'ParentCommandLine">' ParentCommandLine "<" *

Stage 4: `where`

| where ParentCommandLine =~ "C:\\Windows\\System32\\svchost.exe -k DcomLaunch" and CommandLine =~ "C:\\Windows\\System32\\mmc.exe -Embedding"

Stage 5: `parse`

| parse EventData with * 'ProcessGuid">' ProcessGuid "<" * 'Image">' Image "<" * 'Description">' Description "<" * 'CurrentDirectory">' CurrentDirectory "<" * 'User">' User "<" * 'LogonGuid">' LogonGuid "<" * 'ParentProcessGuid">' ParentProcessGuid "<" * 'ParentImage">' ParentImage "<" * 'ParentCommandLine">' ParentCommandLine "<" * 'ParentUser">' ParentUser "<" *

Stage 6: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, User, ParentImage, ParentProcessGuid, ParentCommandLine, ParentUser, Image, ProcessGuid, CommandLine, Description

Stage 7: `extend`

| extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	eq	`C:\Windows\System32\mmc.exe -Embedding`	`field:"CommandLine" kind:eq value:"C:\Windows\System32\mmc.exe -Embedding"`
`EventID`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`EventLog`	eq	`Microsoft-Windows-Sysmon/Operational` corpus 7 (kusto 7)	`field:"EventLog" kind:eq value:"Microsoft-Windows-Sysmon/Operational"`
`ParentCommandLine`	eq	`C:\Windows\System32\svchost.exe -k DcomLaunch`	`field:"ParentCommandLine" kind:eq value:"C:\Windows\System32\svchost.exe -k DcomLaunch"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CommandLine`	`summarize`
`Computer`	`summarize`
`Description`	`summarize`
`EndTime`	`summarize`
`EventID`	`summarize`
`Image`	`summarize`
`ParentCommandLine`	`summarize`
`ParentImage`	`summarize`
`ParentProcessGuid`	`summarize`
`ParentUser`	`summarize`
`ProcessGuid`	`summarize`
`StartTime`	`summarize`
`User`	`summarize`
`DnsDomain`	`extend`
`HostName`	`extend`

Lateral Movement via DCOM

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: parse

Stage 4: where

Stage 5: parse

Stage 6: summarize

Stage 7: extend