Impacket DCOMExec Activity

DCOM is a Microsoft protocol that enables applications to interact with Component Object Model (COM) objects on a remote Windows application. COM objects contain methods and properties that perform specific actions, such as running commands or managing files. For example, MMC20.Application is a COM object with an ExecuteShellCommand method that can accept and run commands on a server.

Impacket is a toolset that includes DCOMExec, a Python script that leverages DCOM to launch unauthorized processes that resemble routine administration. The attacker runs dcomexec.py, which sends a DCOM request over MS-RPC to the target device. This request creates a specific COM object, such as MMC20.Application, ShellWindows, or ShellBrowserWindow. DCOMExec sends an MS-RPC request to map the names of methods and properties on the new COM object to an integer value returned by the server that is called a Dispatch Identifier (DISPID). DCOMExec calls the method by sending an Invoke request with the corresponding DISPID and passes a command through the method parameters, which redirects the command output to a temporary file on an SMB file share. The attacker then retrieves and deletes this file remotely to avoid local logging and blend into legitimate network traffic.