Component Object Model and Distributed COM

let COMShells = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe"]);
let OfficeApps = dynamic(["excel.exe", "outlook.exe", "winword.exe", "powerpnt.exe", "onenote.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (COMShells)
| where (
    // COM Surrogate (dllhost.exe /Processid:) spawning shells — primary DCOM remote activation indicator
    (InitiatingProcessFileName =~ "dllhost.exe" and InitiatingProcessCommandLine has "/Processid:")
    // MMC20.Application abuse — classic DCOM lateral movement vector documented by enigma0x3
    or (InitiatingProcessFileName =~ "mmc.exe" and FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe"))
    // Office application DCOM — Excel, Outlook, or Word spawning shells via COM interfaces
    or (InitiatingProcessFileName in~ (OfficeApps) and FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe"))
  )
| extend COMVector = case(
    InitiatingProcessFileName =~ "dllhost.exe", "COM_Surrogate_Activation",
    InitiatingProcessFileName =~ "mmc.exe", "MMC20_Application_DCOM",
    InitiatingProcessFileName in~ (OfficeApps), "Office_Application_DCOM",
    "Unknown_COM"
  )
| extend DCOMIndicator = InitiatingProcessCommandLine has_any ("/Processid:", "-Embedding")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName, COMVector, DCOMIndicator
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where (ParentImage LIKE "%\\dllhost.exe" OR ParentImage LIKE "%\\mmc.exe" OR ParentImage LIKE "%\\excel.exe" OR ParentImage LIKE "%\\outlook.exe" OR ParentImage LIKE "%\\winword.exe" OR ParentImage LIKE "%\\powerpnt.exe")
| where (Image LIKE "%\\cmd.exe" OR Image LIKE "%\\powershell.exe" OR Image LIKE "%\\pwsh.exe" OR Image LIKE "%\\wscript.exe" OR Image LIKE "%\\cscript.exe" OR Image LIKE "%\\mshta.exe" OR Image LIKE "%\\rundll32.exe")
| eval IsCOMSurrogate=if(ParentImage LIKE "%\\dllhost.exe" AND CommandLine LIKE "%/Processid:%", 1, 0)
| eval IsMMCSpawn=if(ParentImage LIKE "%\\mmc.exe", 1, 0)
| eval IsOfficeSpawn=if(ParentImage LIKE "%\\excel.exe" OR ParentImage LIKE "%\\outlook.exe" OR ParentImage LIKE "%\\winword.exe" OR ParentImage LIKE "%\\powerpnt.exe", 1, 0)
| eval COMVector=case(IsCOMSurrogate=1, "COM_Surrogate_Activation", IsMMCSpawn=1, "MMC20_Application_DCOM", IsOfficeSpawn=1, "Office_Application_DCOM", true(), "Unknown_COM")
| eval DCOMIndicator=if(match(ParentCommandLine, "(?i)(/Processid:|-Embedding)"), 1, 0)
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, COMVector, DCOMIndicator
| sort - _time

process where event.type == "start"
  and process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
  and (
    (process.parent.name == "dllhost.exe" and process.parent.args : "*/Processid:*")
    or (process.parent.name == "mmc.exe" and process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe"))
    or (process.parent.name in~ ("excel.exe", "outlook.exe", "winword.exe", "powerpnt.exe", "onenote.exe") and process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe"))
  )

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  sourceip,
  QIDNAME(qid) AS event_name,
  "ParentImage",
  "ParentCommandLine",
  "Image",
  "CommandLine",
  CASE
    WHEN LOWER("ParentImage") LIKE '%\dllhost.exe' AND "ParentCommandLine" ILIKE '%/Processid:%' THEN 'COM_Surrogate_Activation'
    WHEN LOWER("ParentImage") LIKE '%\mmc.exe' THEN 'MMC20_Application_DCOM'
    WHEN LOWER("ParentImage") LIKE '%\excel.exe'
      OR LOWER("ParentImage") LIKE '%\outlook.exe'
      OR LOWER("ParentImage") LIKE '%\winword.exe'
      OR LOWER("ParentImage") LIKE '%\powerpnt.exe' THEN 'Office_Application_DCOM'
    ELSE 'Unknown_COM'
  END AS com_vector
FROM events
WHERE LOGSOURCETYPEID(logsourceid) IN (12, 119, 432)
  AND CATEGORYNAME(category) ILIKE '%process%'
  AND devicetime > NOW() - 1 DAYS
  AND (
    LOWER("Image") LIKE '%\cmd.exe'
    OR LOWER("Image") LIKE '%\powershell.exe'
    OR LOWER("Image") LIKE '%\pwsh.exe'
    OR LOWER("Image") LIKE '%\wscript.exe'
    OR LOWER("Image") LIKE '%\cscript.exe'
    OR LOWER("Image") LIKE '%\mshta.exe'
    OR LOWER("Image") LIKE '%\rundll32.exe'
    OR LOWER("Image") LIKE '%\regsvr32.exe'
  )
  AND (
    (LOWER("ParentImage") LIKE '%\dllhost.exe' AND "ParentCommandLine" ILIKE '%/Processid:%')
    OR LOWER("ParentImage") LIKE '%\mmc.exe'
    OR LOWER("ParentImage") LIKE '%\excel.exe'
    OR LOWER("ParentImage") LIKE '%\outlook.exe'
    OR LOWER("ParentImage") LIKE '%\winword.exe'
    OR LOWER("ParentImage") LIKE '%\powerpnt.exe'
  )
ORDER BY devicetime DESC

_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*endpoint*
| where EventID = "1" OR EventCode = "1"
| parse field=ParentImage "*\\*" as ParentPath, ParentProcess nodrop
| parse field=Image "*\\*" as ChildPath, ChildProcess nodrop
| where ChildProcess in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| where (
    (toLowerCase(ParentProcess) = "dllhost.exe" and (ParentCommandLine contains "/Processid:" or ParentCommandLine contains "/processid:"))
    or toLowerCase(ParentProcess) = "mmc.exe"
    or toLowerCase(ParentProcess) in ("excel.exe", "outlook.exe", "winword.exe", "powerpnt.exe", "onenote.exe")
  )
| eval COMVector = if(toLowerCase(ParentProcess) = "dllhost.exe", "COM_Surrogate_Activation",
    if(toLowerCase(ParentProcess) = "mmc.exe", "MMC20_Application_DCOM",
      if(toLowerCase(ParentProcess) in ("excel.exe", "outlook.exe", "winword.exe", "powerpnt.exe", "onenote.exe"), "Office_Application_DCOM",
        "Unknown_COM")))
| eval DCOMIndicator = if(ParentCommandLine matches "(?i)(/Processid:|-Embedding)", "true", "false")
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, COMVector, DCOMIndicator
| sort by _messageTime desc

rule t1175_com_dcom_abuse {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects COM and DCOM abuse (T1175) — shell processes spawned from COM surrogate dllhost.exe, MMC20.Application, or Office application DCOM interfaces indicating local COM execution or DCOM lateral movement"
    mitre_attack_tactic = "Lateral Movement, Execution"
    mitre_attack_technique = "T1175"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe)$/
    (
      (
        $e.principal.process.parent_process.file.full_path = /(?i)\\dllhost\.exe$/
        and $e.principal.process.parent_process.command_line = /(?i)\/Processid:/
      )
      or $e.principal.process.parent_process.file.full_path = /(?i)\\mmc\.exe$/
      or $e.principal.process.parent_process.file.full_path = /(?i)\\(excel|outlook|winword|powerpnt|onenote)\.exe$/
    )

  match:
    $e.principal.hostname over 5m

  outcome:
    $risk_score = max(
      if($e.principal.process.parent_process.file.full_path = /(?i)\\dllhost\.exe$/ and $e.principal.process.parent_process.command_line = /(?i)\/Processid:/, 95,
        if($e.principal.process.parent_process.file.full_path = /(?i)\\mmc\.exe$/, 85, 75))
    )
    $com_vector = if(
      $e.principal.process.parent_process.file.full_path = /(?i)\\dllhost\.exe$/, "COM_Surrogate_Activation",
      if($e.principal.process.parent_process.file.full_path = /(?i)\\mmc\.exe$/, "MMC20_Application_DCOM", "Office_Application_DCOM")
    )
    $target_host = $e.principal.hostname
    $user = $e.principal.user.userid
    $child_process = $e.principal.process.command_line
    $parent_cmdline = $e.principal.process.parent_process.command_line

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName = /^(dllhost\.exe|mmc\.exe|excel\.exe|outlook\.exe|winword\.exe|powerpnt\.exe|onenote\.exe)$/i
| FileName = /^(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe)$/i
| case {
    ParentBaseFileName = /^dllhost\.exe$/i AND ParentCommandLine = /\/Processid:/i
      | COMVector := "COM_Surrogate_Activation" | RiskScore := 95 ;
    ParentBaseFileName = /^mmc\.exe$/i
      | COMVector := "MMC20_Application_DCOM" | RiskScore := 85 ;
    ParentBaseFileName = /^(excel|outlook|winword|powerpnt|onenote)\.exe$/i
      | COMVector := "Office_Application_DCOM" | RiskScore := 75 ;
    *
      | COMVector := "Unknown_COM" | RiskScore := 50
  }
| DCOMIndicator := if(ParentCommandLine = /\/Processid:|-Embedding/i, "true", "false")
| select([_timeutc, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine, COMVector, DCOMIndicator, RiskScore])
| sort(RiskScore, order=desc)