Shell or script host spawned by a remotely activatable COM server

Siemphony@siemphonymediumT1021.003unverified

Catches the execution leg of DCOM lateral movement on the target host: a COM server that can be activated remotely — MMC, an Office application or the COM surrogate — becoming the parent of a command shell, script engine or signed-binary proxy. The parent list populates MITRE's ProcessName tuning knob; the values are ours, chosen for objects whose activation creates a new server process, and the child list is what an operator typically detonates through MMC20.Application.ExecuteShellCommand or an Office Application object. Coverage limits worth stating plainly. ShellWindows and ShellBrowserWindow — the two most widely used DCOM objects — bind to the already-running shell, so the payload is spawned by explorer.exe and this rule is silent on both; explorer.exe is not in the parent list because explorer.exe launching cmd.exe or powershell.exe is ordinary desktop behaviour and would swamp everything else here. Objects that execute in-process leave no child at all — Excel's RegisterXLL loads a DLL into the running excel.exe — and are visible only in the brief's image_load source (Sysmon EventID 7), not in process creation. An operator who names a dropped binary instead of a listed LOLBIN also escapes the child list. wmiprvse.exe is deliberately absent: DCOM underlies WMI remoting, but a WMI provider host spawning a shell is T1047 / T1021.006 and on any estate with management or scanning agents it would supply most of this rule's output under the wrong label. AN0791's first leg — a privileged remote logon and RPC to port 135 shortly before the spawn — is a cross-event correlation over a TimeWindow that Sigma cannot express, so this rule stands on the spawn alone and the analyst should pivot to the matching 4624 type 3 logon by hand; that logon is also the only thing separating this from the T1204 rule (190b7574-8f2d-47cd-b1ed-168a3789ab2e), whose Office parent arm selects the same events from the Execution side. The overlap is intentional, not an accident. Prerequisite: Sysmon EventID 1 is not present in a default install. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0285, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\mmc.exe" or InitiatingProcessFolderPath endswith "\\excel.exe" or InitiatingProcessFolderPath endswith "\\winword.exe" or InitiatingProcessFolderPath endswith "\\powerpnt.exe" or InitiatingProcessFolderPath endswith "\\outlook.exe" or InitiatingProcessFolderPath endswith "\\visio.exe" or InitiatingProcessFolderPath endswith "\\msaccess.exe" or InitiatingProcessFolderPath endswith "\\dllhost.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\msiexec.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\certutil.exe"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\mmc.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\winword.exe" OR ParentImage="*\\powerpnt.exe" OR ParentImage="*\\outlook.exe" OR ParentImage="*\\visio.exe" OR ParentImage="*\\msaccess.exe" OR ParentImage="*\\dllhost.exe") AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\msiexec.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\certutil.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\mmc.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\excel.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\winword.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\powerpnt.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\outlook.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\visio.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\msaccess.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\dllhost.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\msiexec.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\mmc\.exe$|\\excel\.exe$|\\winword\.exe$|\\powerpnt\.exe$|\\outlook\.exe$|\\visio\.exe$|\\msaccess\.exe$|\\dllhost\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\msiexec\.exe$|\\bitsadmin\.exe$|\\certutil\.exe$)</field>    <description>Shell or script host spawned by a remotely activatable COM server</description>    <mitre>      <id>T1021.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: fd9b7e0e-4ab9-4925-9bd9-ec2f26eb7206

ATT&CKT1021.003

T1021.003Distributed Component Object Model

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonlateral movement remote exec

lateral movement remote exec

01 · What this rule detects

Code executed on a remote host from another host inside the network — the step where an attacker moves from their initial foothold to a system that matters.

02 · Telemetry you need

Process creation with parent process on the destination host
Logon events with logon type, to distinguish network from interactive
Service creation events on the destination
Named pipe and SMB activity where available

03 · How the logic works

Remote execution shows up on the destination as a process whose parent is a service host, WMI provider, or the service control manager, combined with a network logon shortly before. Match the parent-child relationships that remote execution produces rather than the tool names — the parentage is a property of how Windows executes remote code and is much harder to avoid than a binary name. Correlating with the preceding logon gives you the source host and account, which is what an analyst needs first.

04 · Common false positives

Remote administration and patch management performing exactly this pattern by design
Monitoring agents that execute remote queries
Clustering and failover software coordinating across nodes
Vulnerability scanners with credentialed scanning enabled

05 · Detection maturity

Tier 1 — starting point: Matches known remote execution tool names.
Tier 2 — tuned: Matches the parent-child patterns remote execution produces, excluding management servers by source.
Tier 3 — correlated: Correlates with the preceding network logon and scores on whether that source-account-destination triple is normal.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude by source host rather than by tool — your management servers are a short, stable list
Direction matters: workstation to server is routine, server to workstation rarely is
Enrich with whether the source account normally authenticates to that destination
Administrative tooling used from an unusual source is the case worth alerting on

Declared by the author

dllhost.exe acting as a normal COM surrogate. Installers, shell extensions and packaged applications routinely run under dllhost.exe and start msiexec.exe or rundll32.exe as part of ordinary servicing, so this parent contributes most of the benign volume and is the reason the rule is not rated higher.
Office documents with legitimate macros or add-ins that shell out. A finance workbook calling cmd.exe or a VBA project driving wscript.exe produces the exact parent-child pair selected here, and nothing in the process-creation event distinguishes it from a remotely activated Excel.Application. This is where MITRE's RemoteHostList and UserContext knobs earn their place — a local interactive user opening a document looks nothing like a rare first-time invocation from another host.
Administrative MMC snap-ins that launch a console or script host — for example a management pack or a custom snap-in offering a run-command action — which are indistinguishable from MMC20.Application abuse without the remote-logon leg.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — DCOM ShellWindows used for lateral movement (Empire)
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1021.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/fd9b7e0e-4ab9-4925-9bd9-ec2f26eb7206

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Shell or script host spawned by a remotely activatable COM server

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it