DCOM Lateral Movement via mmc.exe or mshta.exe Spawning Shell Processes
Detects potential DCOM lateral movement by identifying svchost.exe spawning DCOM host processes (mmc.exe, mshta.exe, wmic.exe) with the '-Embedding' argument, followed by these DCOM host processes spawning command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This pattern is indicative of adversaries leveraging DCOM for remote code execution and subsequent shell access.
Microsoft Sentinel (KQL)
