dcomexec | Detection.FYI

Possible Impacket DCOMExec Connection Attempt - Zeek

Sep 1, 2023 · attack.s0357 attack.execution attack.lateral_movement attack.t1021 attack.t1021.003 ·
Share on:

Detects attempts to connect via DCOM Endpoints, as used by Impacket DCOMExec. This event will occur on successful or unsuccessful attempts using any of the three DCOMExec -object options.

Read More