Inter-Process Communication - DCOM Lateral Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects potential DCOM lateral execution attempts. It specifically looks for TCP traffic to port 135 (typically used by DCOM/RPC) on the home network, containing the byte sequence '|05 00 0b|' within the first 3 bytes of the payload. A threshold of 5 occurrences from the same source within 30 seconds is set to reduce false positives.