DCOM CLSID Registry Lookup and COM Server Activation via svchost DcomLaunch
Detects potential DCOM lateral movement where 'mmc.exe', 'wmiprvse.exe', 'excel.exe', or 'dllhost.exe' are spawned with the '-Embedding' flag by 'svchost.exe' under the 'DcomLaunch' or 'RPCSS' services. This indicates that RPCSS performed a HKCR\CLSID registry lookup and activated a COM server object on the host, which can be abused for remote code execution.
Microsoft Sentinel (KQL)
