MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Lateral Movement/ T1021.003

T1021.003Distributed Component Object Model

T1021.003 — Distributed Component Object Model is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 11 detection use cases covering it.

Lateral Movement

View on the matrix → Filter Detection Library MITRE official spec ↗

11Use cases

0Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1021 · Remote Services

Use cases covering this technique (11)

Impacket Lateral Movement Commandline Parameters ESCU actions · alerting P Impacket Lateral Movement smbexec CommandLine Parameters ESCU actions · alerting P Impacket Lateral Movement WMIExec Commandline Parameters ESCU actions · alerting P Mmc LOLBAS Execution Process Spawn ESCU actions · alerting P Possible Lateral Movement PowerShell Spawn ESCU actions · hunting P Remote Process Instantiation via DCOM and PowerShell ESCU actions · alerting P Remote Process Instantiation via DCOM and PowerShell Script Block ESCU actions · alerting P Windows Excel Spawning Microsoft Project Application ESCU actions · hunting P Windows SpeechRuntime COM Hijacking DLL Load ESCU actions · alerting P Windows SpeechRuntime Suspicious Child Process ESCU actions · alerting P Windows Excel ActiveMicrosoftApp Child Process ESCU actions · hunting P