MMC20.Application DCOM Lateral Movement: mmc.exe Child of svchost.exe

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects the suspicious execution chain where mmc.exe is spawned by svchost.exe via DCOM activation (indicated by '-Embedding' in the command line), followed by mmc.exe spawning a command shell (cmd.exe, powershell.exe, or pwsh.exe). This behavior is indicative of lateral movement or privilege escalation using DCOM and MMC20.Application.