WMI DCOM Port Recon - Endpoint Mapper

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects WMI DCOM port reconnaissance activity targeting the Endpoint Mapper service on port 135. It triggers an alert when a source IP initiates 10 or more TCP SYN packets to port 135 on the HOME_NET within a 30-second window, indicating a potential network scan.