T1021.003 Distributed Component Object Model — Attack Simulation

Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user. The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

PowerShell Lateral Movement Using Excel Application Object
windows automated powershell
Procedure 505f24be-1c11-4694-b614-e01ae1cd2570; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
PowerShell Lateral Movement using MMC20
windows automated powershell
Procedure 6dc74eb1-c9d6-4c53-b3b5-6f50ae339673; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows lateral-movement isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate subtechnique source_mapped

Detection and collection

T1021.003 detection workspace

Attack tools

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.