WMI Lateral Movement via DCOM OXID Resolver on Port 135

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects potential lateral movement attempts using DCOM-based WMI calls to the remote OXID Resolver on port 135. Attackers often abuse DCOM to remotely trigger WMI methods, enabling remote code execution, discovery, or other malicious activities. The rule triggers on the characteristic DCOM OXID Resolve packet structure associated with this activity.