One Day Sec

What is DCOM and how can it be used for lateral movement in a domain environment?

DCOM (Distributed Component Object Model) allows software components to communicate across networked computers. Attackers can abuse DCOM objects like `MMC20.Application` to execute arbitrary programs on remote systems. This technique is detailed in Domain Penetration - Executing Programs on Remote Systems Using DCOM. It bypasses traditional remote execution methods and works on Windows 7 through Windows 10, often requiring administrative credentials.
DCOMlateral movementMMC20.Applicationremote executiondomain penetration

Browse all Q&A →