Remote DCOM/WMI Lateral Movement — Detection Rule
Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.
Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.