DCOM Application Instantiation (MMC)

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•5

Detects Microsoft Management Console (mmc.exe) instantiated as a DCOM object (-Embedding) by the DCOM service host. This is a documented vector for DCOM lateral movement via the MMC20.Application COM object.