Adversaries love leveraging legitimate functionality that lays dormant inside of Microsoft Windows for malicious purposes and often disguise their activity under the smoke screen of "normal administrator behavior." Over the last year, there has been a significant surge in the malicious use of Component Object Model (COM) objects as a "living off the land" approach to lateral movement. COM, a subsystem that has been around since the early days of Microsoft Windows, exposes interfaces and functionality within software objects and has the ability to share this functionality over the network via Distributed COM (DCOM). With over 20 years in existence and over a year of relative popularity among adversaries, one would imagine that network analysis and detection of DCOM attacks was old news. On the contrary, very few people understand the techniques, tools fail to properly parse the network protocol, and adversaries continue to successfully leverage it to further the compromise of networks. Needless to say, it's difficult to defend against techniques that the defenders don't understand.
This talk aims to address that knowledge gap by exploring DCOM as a lateral movement technique and provide a methodical walk through of the technique from both the attacker and defender perspectives. The audience will get a deep dive into:
•[D]COM 101
•How does an adversary choose a COM object for lateral movement
•NSM approaches with regards to DCOM (pros vs cons)
•Network protocol analysis of the attack using open source tools