T1021.003: Distributed Component Object Model
Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.
The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.[1][2]
Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.[3] By default, only Administrators may remotely activate and launch COM objects through DCOM.[4]
Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications[5] as well as other Windows objects that contain insecure methods.[6][7] DCOM can also execute macros in existing documents[8] and may also invoke Dynamic Data Exchange (DDE) execution directly through a COM created instance of a Microsoft Office application[9], bypassing the need for a malicious document. DCOM can be used as a method of remotely interacting with Windows Management Instrumentation. [10]
Analyst context for executives and security teams
DCOM lateral movement matters because it can turn a valid privileged Windows account into remote execution on another machine using built-in Windows COM/RPC functionality. For leaders, the business issue is not a new malware family; it is whether privileged identity, Windows administrative paths, and east-west network access are controlled and observable enough to stop or investigate movement between workstations and servers.
Executive priority
Prioritize this where Windows systems, domain administration, Office automation, WMI, or broad internal connectivity are material to operations. Executive questions should focus on: who can remotely activate DCOM objects, whether administrative privileges are limited and audited, whether network segmentation restricts lateral movement, and whether incident responders can reconstruct remote COM/RPC activity across hosts. This technique is especially relevant to resilience and audit evidence because it tests least privilege, privileged account governance, internal network controls, and SOC visibility over native Windows behavior.
Technical view
This is a Windows lateral-movement sub-technique under Remote Services. ATT&CK states adversaries may use Valid Accounts to interact with remote machines through DCOM and act as the logged-on user. DCOM extends COM over RPC; permissions are controlled through Registry ACLs, and remote launch/activation is generally limited to Administrators by default. SOC and IR teams should validate monitoring around remote DCOM activation, RPC-based host-to-host connections, privileged account use, and unusual COM server activity involving Office applications, MMC-related objects, or WMI interaction. The related detection strategy, DET0285, indicates a multi-event behavioral approach for DCOM-based remote code execution rather than reliance on a single indicator.
Likely telemetry
- Windows authentication and logon records showing privileged account use between hosts
- Endpoint process creation and parent-child process activity on the remote Windows system
- Host-to-host network telemetry for RPC/DCOM communication inside the environment
- Registry configuration and ACL evidence for COM/DCOM launch and activation permissions
- Application execution evidence for COM servers such as Office applications, MMC-related components, or WMI-related activity
Detection direction
- Use multi-event correlation where possible: valid account logon, internal RPC/DCOM connection, remote COM activation, and resulting process or application behavior on the target host.
- Tune for unusual source-to-destination pairs, privileged accounts used from atypical systems, and DCOM activity that leads to Office, MMC, macro, DDE, or WMI-related execution paths.
- Account for legitimate administrative and enterprise management activity; false positives may come from authorized remote administration, automation, or software management workflows.
- Validate visibility on both the initiating and target Windows hosts. A common blind spot is having authentication logs without endpoint process context, or network telemetry without user attribution.
- Because ATT&CK provides no official detection text for this object, detection quality should be proven with local baselines and controlled validation rather than assumed from generic Windows logging.
Mitigation priorities
- Start with Privileged Account Management: enforce least privilege, restrict administrative rights, monitor privileged account usage, and ensure accountability through logging and auditing.
- Apply Network Segmentation to limit which systems can initiate remote administrative/DCOM-style communication to sensitive hosts.
- Disable or remove unnecessary software, features, or services that expose unneeded COM/DCOM attack surface, especially where business use is not required.
- Use Application Isolation and Sandboxing where applicable to contain risky application behavior and reduce the impact of abused application components.
- Review Registry-based COM/DCOM permissions and remote activation rights as part of Windows hardening and privileged access reviews.
Analyst notes and limits
Relationship context shows this sub-technique is used by Cobalt Strike, Empire, and SILENTTRINITY, all of which are described as remote administration or post-exploitation frameworks. That relationship is useful for threat-informed testing, but it should not be interpreted as attribution or evidence of activity in any environment. The strongest defensive value is validating whether native Windows remote execution paths are governed by identity controls, segmentation, and endpoint telemetry.
The supplied ATT&CK object has no official detection text and is limited to the Windows platform. This take relies only on the provided ATT&CK description, references, and relationships. Local architecture, DCOM usage, administrative workflows, logging configuration, and business-critical Windows dependencies must be reviewed before setting policy or alert thresholds.
Distributed Component Object Model
Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.
The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.[1][2]
Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.[3] By default, only Administrators may remotely activate and launch COM objects through DCOM.[4]
Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications[5] as well as other Windows objects that contain insecure methods.[6][7] DCOM can also execute macros in existing documents[8] and may also invoke Dynamic Data Exchange (DDE) execution directly through a COM created instance of a Microsoft Office application[9], bypassing the need for a malicious document. DCOM can be used as a method of remotely interacting with Windows Management Instrumentation. [10]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1021 | Remote Services | This object subtechnique of Remote Services. |
Groups, software, and campaigns
S0363: Empire
Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]
S0692: SILENTTRINITY
SILENTTRINITY is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. SILENTTRINITY was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.[1][2]
S0154: Cobalt Strike
Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]
In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.3 | Current bundle | 1c452a46cc31… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Fireeye Hunting COM June 2019
Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019.
Open source URL -
[2]
Microsoft COM
Microsoft. (n.d.). Component Object Model (COM). Retrieved November 22, 2017.
Open source URL -
[3]
Microsoft Process Wide Com Keys
Microsoft. (n.d.). Setting Process-Wide Security Through the Registry. Retrieved November 21, 2017.
Open source URL -
[4]
Microsoft COM ACL
Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017.
Open source URL -
[5]
Enigma Outlook DCOM Lateral Movement Nov 2017
Nelson, M. (2017, November 16). Lateral Movement using Outlook's CreateObject Method and DotNetToJScript. Retrieved November 21, 2017.
Open source URL -
[6]
Enigma MMC20 COM Jan 2017
Nelson, M. (2017, January 5). Lateral Movement using the MMC20 Application COM Object. Retrieved November 21, 2017.
Open source URL -
[7]
Enigma DCOM Lateral Movement Jan 2017
Nelson, M. (2017, January 23). Lateral Movement via DCOM: Round 2. Retrieved November 21, 2017.
Open source URL -
[8]
Enigma Excel DCOM Sept 2017
Nelson, M. (2017, September 11). Lateral Movement using Excel.Application and DCOM. Retrieved November 21, 2017.
Open source URL -
[9]
Cyberreason DCOM DDE Lateral Movement Nov 2017
Tsukerman, P. (2017, November 8). Leveraging Excel DDE for lateral movement via DCOM. Retrieved November 21, 2017.
Open source URL -
[10]
MSDN WMI
Microsoft. (n.d.). Windows Management Instrumentation. Retrieved April 27, 2016.
Open source URL -
[11]
mitre-attack T1021.003Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.