1. Home
  2. ATT&CK Techniques
  3. T1021.003 Distributed Component Object Model

T1021.003 Distributed Component Object Model

Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.

The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)(Citation: Microsoft COM)

Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.(Citation: Microsoft Process Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.(Citation: Microsoft COM ACL)

Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents(Citation: Enigma Excel DCOM Sept 2017) and may also invoke Dynamic Data Exchange (DDE) execution directly through a COM created instance of a Microsoft Office application(Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document. DCOM can be used as a method of remotely interacting with Windows Management Instrumentation. (Citation: MSDN WMI)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.IR-01.05 Remote access protection Mitigates T1021.003 Distributed Component Object Model
Comments
This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access.
References
    PR.AA-05.02 Privileged system access Mitigates T1021.003 Distributed Component Object Model
    Comments
    This diagnostic statement protects against Distributed Component Object Model through the use of privileged account management and the use of multi-factor authentication.
    References
      DE.CM-06.02 Third-party access monitoring Mitigates T1021.003 Distributed Component Object Model
      Comments
      This diagnostic statement protects against Distributed Component Object Model through the use of privileged account management. Employing auditing, privilege access management, and just in time access protects against adversaries trying to obtain illicit access to critical systems.
      References
        PR.PS-05.02 Mobile code prevention Mitigates T1021.003 Distributed Component Object Model
        Comments
        Mobile code procedures address specific actions taken to prevent the development, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.
        References
          PR.AA-05.03 Service accounts Mitigates T1021.003 Distributed Component Object Model
          Comments
          This diagnostic statement is for the implementation of security controls for service accounts (i.e., accounts used by systems to access other systems). Minimize service account permissions and access for the service to mitigate exploitation via Distributed Component Object Model (DCOM).
          References
            PR.IR-01.01 Network segmentation Mitigates T1021.003 Distributed Component Object Model
            Comments
            This diagnostic statement is for the implementation of network segmentation which helps prevent access to critical systems and sensitive information. Employing measures such as Windows Firewall provides protection against adversaries attempting to exploit Distributed Component Object Model.
            References
              PR.IR-01.02 Network device configurations Mitigates T1021.003 Distributed Component Object Model
              Comments
              This diagnostic statement provides protection through secure network device configurations (e.g., firewall rules, ports, protocols) aligned to security baselines. Using network appliances to block or filter network traffic that is not necessary within the environment can mitigate adversary use of remote services.
              References
                PR.IR-01.04 Wireless network protection Mitigates T1021.003 Distributed Component Object Model
                Comments
                This diagnostic statement provides protections for wireless networks. Implementation of wireless network management measures such as network segmentation and access controls reduces the attack surface, restricts movement by adversaries, and protects data from compromise.
                References
                  PR.IR-01.06 Production environment segregation Mitigates T1021.003 Distributed Component Object Model
                  Comments
                  This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise.
                  References

                    NIST 800-53 Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    CM-06 Configuration Settings mitigates T1021.003 Distributed Component Object Model
                    CM-05 Access Restrictions for Change mitigates T1021.003 Distributed Component Object Model
                    AC-17 Remote Access mitigates T1021.003 Distributed Component Object Model
                    SC-18 Mobile Code mitigates T1021.003 Distributed Component Object Model
                    SC-03 Security Function Isolation mitigates T1021.003 Distributed Component Object Model
                    RA-05 Vulnerability Monitoring and Scanning mitigates T1021.003 Distributed Component Object Model
                    CM-08 System Component Inventory mitigates T1021.003 Distributed Component Object Model
                    SC-46 Cross Domain Policy Enforcement mitigates T1021.003 Distributed Component Object Model
                    SI-03 Malicious Code Protection mitigates T1021.003 Distributed Component Object Model
                    CM-02 Baseline Configuration mitigates T1021.003 Distributed Component Object Model
                    IA-02 Identification and Authentication (Organizational Users) mitigates T1021.003 Distributed Component Object Model
                    CM-07 Least Functionality mitigates T1021.003 Distributed Component Object Model
                    SI-04 System Monitoring mitigates T1021.003 Distributed Component Object Model
                    AC-02 Account Management mitigates T1021.003 Distributed Component Object Model
                    AC-03 Access Enforcement mitigates T1021.003 Distributed Component Object Model
                    AC-04 Information Flow Enforcement mitigates T1021.003 Distributed Component Object Model
                    AC-05 Separation of Duties mitigates T1021.003 Distributed Component Object Model
                    AC-06 Least Privilege mitigates T1021.003 Distributed Component Object Model
                    SC-07 Boundary Protection mitigates T1021.003 Distributed Component Object Model

                    VERIS Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1021.003 Distributed Component Object Model
                    action.malware.variety.Brute force Brute force attack related-to T1021.003 Distributed Component Object Model

                    Azure Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    azure_network_security_groups Azure Network Security Groups technique_scores T1021.003 Distributed Component Object Model
                    Comments
                    This control can be used to restrict direct access to remote services to trusted networks. This mitigates even an adversary with a valid account from accessing resources. This can be circumvented though if an adversary is able to compromise a trusted host and move laterally to a protected network. This results in an overall partial (coverage) score.
                    References
                    1. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
                    azure_network_watcher_traffic_analytics Azure Network Watcher: Traffic Analytics technique_scores T1021.003 Distributed Component Object Model
                    Comments
                    This control can detect anomalous traffic with respect to remote access protocols and groups.
                    References
                    1. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas

                    AWS Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    amazon_virtual_private_cloud Amazon Virtual Private Cloud technique_scores T1021.003 Distributed Component Object Model
                    Comments
                    VPC security groups and network access control lists (NACLs) can be used to restrict direct access to remote services to trusted networks. This mitigates even an adversary with a valid account from accessing resources. This can be circumvented though if an adversary is able to compromise a trusted host and move laterally to a protected network. This results in an overall partial (coverage) score.
                    References