Detecting DCOM Lateral Movement: MMC20, ShellWindows and ShellBrowserWindow

Distributed COM lets a remote client instantiate a COM object on another machine and call its methods. A handful of objects expose methods that run commands, notably MMC20.Application (ExecuteShellCommand), ShellWindows and ShellBrowserWindow. No new service and no new listener is required, so detection relies on process lineage and RPC traffic.

Signals at a Glance

Process Lineage Signals

MMC20.Application launches mmc.exe with the -Embedding argument, and its ExecuteShellCommand method starts the command as its child. That chain, mmc.exe -Embedding then cmd.exe, essentially never occurs from a user. ShellWindows and ShellBrowserWindow instead reuse an existing explorer.exe, so the tell is an Explorer child with no matching console logon:

title: MMC20 DCOM Spawning Interpreter
logsource:
  product: windows
  category: process_creation
detection:
  parent:
    ParentImage|endswith: '\mmc.exe'
    ParentCommandLine|contains: '-Embedding'
  child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
  condition: parent and child
level: high
# tune/validate: expect near-zero hits; any MMC snap-in that launches helpers needs an exception.

// Microsoft Defender (KQL) - explorer.exe child on a server with no recent interactive logon
let interactive = DeviceLogonEvents
| where LogonType in ("Interactive", "RemoteInteractive", "CachedInteractive")
| project DeviceName, AccountName, LogonTime=Timestamp;
DeviceProcessEvents
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| where DeviceName in~ (server_hosts)   // watchlist of servers; placeholder name
| join kind=leftanti (interactive) on DeviceName, AccountName
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
// tune/validate: confirm AccountName alignment between the two tables in your tenant.

RPC Traffic and Hardening

DCOM activation always begins with a connection to the endpoint mapper on port 135, followed by a connection to a high port assigned for the object. Zeek’s dce_rpc.log records the interface and operation, so remote activation (RemoteCreateInstance on the system activator interface) from a workstation to a server is visible without any host agent.

• Alert on workstation-to-workstation RPC to 135 and the following ephemeral port; peers rarely need to talk this way.
• Review DCOM hardening events: System log Event 10036 and 10037 relate to the DCOM authentication-level hardening, and failures there can show scanning behaviour.
• Disable remote DCOM launch and activation permissions where there is no business need, and block port 135 between user VLANs with host or network firewalls.
• Remember Office objects: Excel.Application and similar COM servers also expose command execution, so apply the same lineage logic to excel.exe launched with -Embedding.