COM Object Remote Activation via DCOM
This rule detects remote activation of COM objects via DCOM (Distributed Component Object Model) on TCP port 135. It specifically looks for the byte sequence '|05 00 0b|' and the string 'IDispatch' within the network flow, indicating an attempt to interact with COM objects remotely. This activity can be associated with lateral movement or execution techniques by attackers.
Suricata
