DCOM Application Instantiation (MMC)

Ethan Andrews@eandrews

•updated Jun 18, 2026•3•0•4

Detects Microsoft Management Console (mmc.exe) instantiated as a DCOM object (-Embedding) by the DCOM service host. This is a documented vector for DCOM lateral movement via the MMC20.Application COM object.