I Like to Move It: Windows Lateral Movement Part 2 - DCOM - MDSec
Tags
cmtmf-attack-pattern: Process Injection
attack-pattern: Direct Distributed Component Object Model - T1021.003 Powershell - T1059.001 Process Injection - T1631 Server - T1583.004 Server - T1584.004 Software - T1592.002 Distributed Component Object Model - T1175 Powershell - T1086 Process Injection - T1055
Show in Graph
Common Information
Type Value
UUID e6ea5608-b668-4ae1-ae63-64c2afa21470
Fingerprint ad2cc9103dfc19ad
Analysis status DONE
Considered CTI value 0
Text language
Published Sept. 17, 2020, 3:01 p.m.
Added to db Jan. 18, 2023, 11:28 p.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline I Like to Move It: Windows Lateral Movement Part 2 – DCOM
Title I Like to Move It: Windows Lateral Movement Part 2 - DCOM - MDSec
Detected Hints/Tags/Attributes 28/2/5
Source URLs
Redirection Url
Details Source https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-2-dcom/
URL Provider
Details Provider Source level domain
Details mdsec.co.uk www.mdsec.co.uk
Attributes
Details Type #Events CTI Value
Details File 1260 
explorer.exe
Details File 199 
excel.exe
Details File 312 
calc.exe
Details File 1 
excel.log
Details File 172 
dllhost.exe