ACE Responder on Twitter: "Do you know what DCOM lateral movement looks like? It can be much more difficult to recognize than WMI/PSExec. The MMC20.Application procedure is more reliable than the others. Look for mmc.exe spawning strange child procs. #ThreatHunting #DFIR https://t.co/HIegxXiNBJ" / Twitter
https://twitter.com/i/web/status/1641957092998168576