{'created': '2020-02-11T18:26:36.444Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may use [Valid '
                'Accounts](https://attack.mitre.org/techniques/T1078) to '
                'interact with remote machines by taking advantage of '
                'Distributed Component Object Model (DCOM). The adversary may '
                'then perform actions as the logged-on user.\n'
                '\n'
                'The Windows Component Object Model (COM) is a component of '
                'the native Windows application programming interface (API) '
                'that enables interaction between software objects, or '
                'executable code that implements one or more interfaces. '
                'Through COM, a client object can call methods of server '
                'objects, which are typically Dynamic Link Libraries (DLL) or '
                'executables (EXE). Distributed COM (DCOM) is transparent '
                'middleware that extends the functionality of COM beyond a '
                'local computer using remote procedure call (RPC) '
                'technology.(Citation: Fireeye Hunting COM June '
                '2019)(Citation: Microsoft COM)\n'
                '\n'
                'Permissions to interact with local and remote server COM '
                'objects are specified by access control lists (ACL) in the '
                'Registry.(Citation: Microsoft Process Wide Com Keys) By '
                'default, only Administrators may remotely activate and launch '
                'COM objects through DCOM.(Citation: Microsoft COM ACL)\n'
                '\n'
                'Through DCOM, adversaries operating in the context of an '
                'appropriately privileged user can remotely obtain arbitrary '
                'and even direct shellcode execution through Office '
                'applications(Citation: Enigma Outlook DCOM Lateral Movement '
                'Nov 2017) as well as other Windows objects that contain '
                'insecure methods.(Citation: Enigma MMC20 COM Jan '
                '2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM '
                'can also execute macros in existing documents(Citation: '
                'Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic '
                'Data Exchange](https://attack.mitre.org/techniques/T1559/002) '
                '(DDE) execution directly through a COM created instance of a '
                'Microsoft Office application(Citation: Cyberreason DCOM DDE '
                'Lateral Movement Nov 2017), bypassing the need for a '
                'malicious document. DCOM can be used as a method of remotely '
                'interacting with [Windows Management '
                'Instrumentation](https://attack.mitre.org/techniques/T1047). '
                '(Citation: MSDN WMI)',
 'external_references': [{'external_id': 'T1021.003',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1021/003'},
                         {'description': 'Hamilton, C. (2019, June 4). Hunting '
                                         'COM Objects. Retrieved June 10, '
                                         '2019.',
                          'source_name': 'Fireeye Hunting COM June 2019',
                          'url': 'https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html'},
                         {'description': 'Microsoft. (n.d.). Component Object '
                                         'Model (COM). Retrieved November 22, '
                                         '2017.',
                          'source_name': 'Microsoft COM',
                          'url': 'https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx'},
                         {'description': 'Microsoft. (n.d.). DCOM Security '
                                         'Enhancements in Windows XP Service '
                                         'Pack 2 and Windows Server 2003 '
                                         'Service Pack 1. Retrieved November '
                                         '22, 2017.',
                          'source_name': 'Microsoft COM ACL',
                          'url': 'https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1'},
                         {'description': 'Microsoft. (n.d.). Setting '
                                         'Process-Wide Security Through the '
                                         'Registry. Retrieved November 21, '
                                         '2017.',
                          'source_name': 'Microsoft Process Wide Com Keys',
                          'url': 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx'},
                         {'description': 'Microsoft. (n.d.). Windows '
                                         'Management Instrumentation. '
                                         'Retrieved April 27, 2016.',
                          'source_name': 'MSDN WMI',
                          'url': 'https://msdn.microsoft.com/en-us/library/aa394582.aspx'},
                         {'description': 'Nelson, M. (2017, January 23). '
                                         'Lateral Movement via DCOM: Round 2. '
                                         'Retrieved November 21, 2017.',
                          'source_name': 'Enigma DCOM Lateral Movement Jan '
                                         '2017',
                          'url': 'https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/'},
                         {'description': 'Nelson, M. (2017, January 5). '
                                         'Lateral Movement using the MMC20 '
                                         'Application COM Object. Retrieved '
                                         'November 21, 2017.',
                          'source_name': 'Enigma MMC20 COM Jan 2017',
                          'url': 'https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/'},
                         {'description': 'Nelson, M. (2017, November 16). '
                                         "Lateral Movement using Outlook's "
                                         'CreateObject Method and '
                                         'DotNetToJScript. Retrieved November '
                                         '21, 2017.',
                          'source_name': 'Enigma Outlook DCOM Lateral Movement '
                                         'Nov 2017',
                          'url': 'https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/'},
                         {'description': 'Nelson, M. (2017, September 11). '
                                         'Lateral Movement using '
                                         'Excel.Application and DCOM. '
                                         'Retrieved November 21, 2017.',
                          'source_name': 'Enigma Excel DCOM Sept 2017',
                          'url': 'https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/'},
                         {'description': 'Tsukerman, P. (2017, November 8). '
                                         'Leveraging Excel DDE for lateral '
                                         'movement via DCOM. Retrieved '
                                         'November 21, 2017.',
                          'source_name': 'Cyberreason DCOM DDE Lateral '
                                         'Movement Nov 2017',
                          'url': 'https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom'}],
 'id': 'attack-pattern--68a0c5ed-bee2-4513-830d-5b0d650139bd',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'lateral-movement'}],
 'modified': '2025-10-24T17:48:53.724Z',
 'name': 'Distributed Component Object Model',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows'],
 'x_mitre_version': '1.3'}