DCOM lateral movement (via MMC20)

title: DCOM lateral movement (via MMC20)
description: Detects scenarios where an attacker execute the Impacket DCOMexec tool in order to abuse DCOM services.  
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.003-Distributed%20Component%20Object%20Model%20(DCOM)
- https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/
- https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/dcomexec.py
- https://www.ired.team/offensive-security/lateral-movement/t1175-distributed-component-object-model
- https://www.synacktiv.com/publications/traces-of-windows-remote-command-execution.html
tags:
- attack.lateral_movement
- attack.t1021.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:  # full command: '[System.Activator]::CreateInstance([type]::GetTypeFromProgID('MMC20.Application.1','target_host'))''

  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - '[System.Activator]'
      - 'CreateInstance'
      - 'GetTypeFromProgID'
      - 'MMC20.Application'

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - '[System.Activator]'
      - 'CreateInstance'
      - 'GetTypeFromProgID'
      - 'MMC20.Application'

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - '[System.Activator]'
      - 'CreateInstance'
      - 'GetTypeFromProgID'
      - 'MMC20.Application'

  condition: 1 of selection*
falsepositives:
- none
level: high