Network Defender Archeology: An NSM Case Study in Lateral Movement with DCOM
summary
Shows that DCOM can execute code remotely (PowerShell executeShellCommand and Excel loading an arbitrary DLL) and popped calc.exe via DCOM during demos. Walks through RPC/COM packet fields, how getFuncDesc/getNames/getDocumentation produce a member ID and how IDispatch Invoke runs the method. Uses Zeek (Bro) logs, Suricata content rules and Wireshark dissectors, then modified Zeek and Wireshark dissectors to extract CLSIDs and method args. Provides strict/loose/exclusion detection criteria and reports at least one true positive on deployed rules.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:37DCOM threat overview
- 3:37Understanding COM
- 6:53Decom protocol internals
- 8:49Adversarial DCOM usage
- 13:06DCOM network behavior
- 17:57Deep dive into phases
- 23:48Detection criteria
- 28:35Detection methodology
- 35:19Tools and parsing
- 43:12Endpoint context and Q&A
related talks
50mThe Beast Within - Evading Dynamic Malware Analysis Using Microsoft COM
43mHunting for Bugs, Catching Dragons
25mCommSec D1 - A Deep Dive Into Malicious Documents
39mWindows Agentless C2: (Ab)using the MDM Client Stack
01h 40mDefending against PowerShell attacks - in theory, and in practice
48m"Sneaking Past Device Guard"
45mD2T1 - Expanding Your WMI Lateral Movement Arsenal
59mDSCOMPROMISED: A Windows DSC Attack Framework