COM enables different Windows components and software to communicate with each other. DCOM is COM but spans across Windows hosts.

Summary

  • Interaction with DCOM is done over RPC on TCP port 135
  • Local administrator access required to call the DCOM Service Control Manager (API)
  • MS Office DCOM objects (especially Outlook and PowerPoint) often enables lateral movement to workstations (as they often have MS Office installed)