Distributed Component Object Model

Subtechnique · ATTACK:enterprise:T1021.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1021.003",
  "title": "Distributed Component Object Model",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1021/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--68a0c5ed-bee2-4513-830d-5b0d650139bd",
  "external_id": "T1021.003",
  "domain": "enterprise",
  "created": "2020-02-11T18:26:36.444Z",
  "modified": "2025-10-24T17:48:53.724Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "lateral-movement"
  ],
  "source_references": [
    {
      "source_name": "Fireeye Hunting COM June 2019",
      "url": "https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html"
    },
    {
      "source_name": "Microsoft COM",
      "url": "https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx"
    },
    {
      "source_name": "Microsoft COM ACL",
      "url": "https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1"
    },
    {
      "source_name": "Microsoft Process Wide Com Keys",
      "url": "https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx"
    },
    {
      "source_name": "MSDN WMI",
      "url": "https://msdn.microsoft.com/en-us/library/aa394582.aspx"
    },
    {
      "source_name": "Enigma DCOM Lateral Movement Jan 2017",
      "url": "https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/"
    },
    {
      "source_name": "Enigma MMC20 COM Jan 2017",
      "url": "https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/"
    },
    {
      "source_name": "Enigma Outlook DCOM Lateral Movement Nov 2017",
      "url": "https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/"
    },
    {
      "source_name": "Enigma Excel DCOM Sept 2017",
      "url": "https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/"
    },
    {
      "source_name": "Cyberreason DCOM DDE Lateral Movement Nov 2017",
      "url": "https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom"
    }
  ]
}

Explicit source assertions (8)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.