Catalogue
ATT&CK

Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Search detections

Filters

Loading detections…

Loading detections

The public catalogue of detection rules. Every entry carries its source, the identifier it had there, its licence and its ATT&CK mapping.

Product

Catalogue ATT&CK Create a workspace

Trust

Security Privacy Licences Terms

Contact

Report a vulnerability Report a content issue contacto@detections.app

HighElastic detection rules

Incoming DCOM Lateral Movement via MSHTA

Identifies the use of Distributed Component Object Model (DCOM) to execute commands from a remote host, which are launched via the HTA Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally while attempting to evade detection.

ATT&CK coverage

Outside the enterprise matrix

T1021Remote Services 108 detections cover this technique
T1021.003Distributed Component Object Model 31 detections cover this technique
T1218System Binary Proxy Execution 235 detections cover this technique
T1218.005Mshta 46 detections cover this technique
T1559Inter-Process Communication 19 detections cover this technique
T1559.001Component Object Model 16 detections cover this technique

Detection requirements

Log source category: event_index

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Provenance

Where this detection came from, and what you may do with it.

At source: Open at source
Written by: Elastic
Licence: Elastic License 2.0Read the licence
Published: Aug 27, 2026
Version: 1