Shell Process Spawned as Child of mmc.exe via DCOM Lateral Movement
Detects the execution of command-line interpreters or scripting engines (cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe) as a child process of mmc.exe, specifically when mmc.exe is launched with the '-Embedding' flag. This behavior is consistent with lateral movement techniques leveraging the MMC20.Application COM object's ExecuteShellCommand method via Distributed Component Object Model (DCOM).
Microsoft Sentinel (KQL)
