MMC20 COM Object Lateral Movement via DCOM

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to perform lateral movement using the MMC20 COM object via DCOM. It specifically looks for TCP traffic destined for port 135 (typically used by DCOM) containing the string "MMC20.Application" in a case-insensitive manner. This indicates an attempt to instantiate the MMC20.Application COM object, which can be abused for remote code execution and lateral movement.