WMI Lateral Movement via DCOM OXID Resolver or IWbemServices UUID on TCP/135

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.