Remote DCOM/WMI Lateral Movement

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•0•0

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.