DCOM Lateral Movement via mmc.exe or dllhost.exe
Detects Distributed Component Object Model (DCOM) lateral movement activity by monitoring for mmc.exe and dllhost.exe network connections to non-local endpoints or when these processes are spawned by suspicious parent processes typically associated with command execution or malicious behavior.
Microsoft Sentinel (KQL)
