Remote DCOM/WMI Lateral Movement via RPC Firewall

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•25

Detects remote RPC calls that perform remote DCOM operations, which can be abused for lateral movement via DCOM or WMI. The rule specifically looks for RPC Firewall events with EventID 3 and a set of Interface UUIDs associated with DCOM and WMI activities.