DCOM Turns 20: Revisiting A Legacy Interface In The Modern Threatscape

The talk revisits the Component Object Model (COM) and its network counterpart, DCOM, which remain deeply embedded in Windows and Active Directory environments and keep appearing in recent security research. The speaker, Julien Bedel, pitches it as a beginner-level introduction. He explains how a program turns a friendly ProgID into a CLSID through the registry, then loads the server DLL that exposes an object's interfaces, methods and properties.

Following the mechanism through the kill chain, the talk starts with initial access, where COM classes can run commands or download files from a phishing payload. For persistence, it shows how registry lookups fall back from the current user hive to machine-wide settings, so a planted CLSID in HKCU can redirect a program to an attacker's DLL. Good hijack candidates are programs that launch often, keep running and reach the internet, such as office suites, browsers, VPN clients and endpoint agents.

For lateral movement, only classes with an AppID can be activated remotely over DCOM on TCP 135. With administrator rights on a target, the speaker runs a command through a remote class, a method resembling a known Python tool. He then applies remote COM hijacking to run code as a domain administrator logged on interactively elsewhere. Defensive ideas include alerting on unusual HKCU CLSID changes, unsigned or oddly located DLLs, and workstations contacting COM servers they rarely use, alongside RPC filtering and least-privilege network segmentation. The takeaway is that an old mechanism still yields new research, and basic controls still matter.