DCOM Explained: How Attackers Turn a Windows Feature into a Lateral Movement Tool

This report outlines detection and prevention techniques for lateral movement via DCOM: it provides example Security and Sysmon events showing remote logons, RPC over port 135, DCOM-host processes (e.g., mmc.exe) launched by svchost, and child shells executing a PowerShell downloader; it also describes a correlation rule and mitigations (block TCP 135, remove remote activation rights for non-admins, deploy LAPS).