Yet another DCOM object for lateral movement

Kaspersky’s Securelist report, published on 19 December 2025, describes a previously undocumented DCOM object used for command execution and persistence via Control Panel items, focusing on three exposed objects: ShellWindows, ShellBrowserWindow and MMC20. It explains that ShellWindows and ShellBrowserWindow can be leveraged for remote command execution, with MMC20 historically functioning but now triggering Defender alerts on Windows Server 2025, Windows Server 2022, Windows 11 and Windows 10.

The research also details how a COpenControlPanel COM object loaded via the COM Surrogate process (dllhost.exe) can be exploited to spawn a DLL loaded from registry-registered Control Panel locations, enabling remote triggering through DCOM. Pathways for detection are outlined, including monitoring registry locations under HKCU and HKLM for Control Panel Cpls entries and watching dllhost.exe for unusual COM activity.

The article additionally covers enumeration approaches for COM/DCOM objects, including PowerShell and C++ methods, and notes that many objects lack TypeLibs, complicating automatic identification. It concludes by emphasising the substantial attack surface of DCOM and the importance of registry hardening and runtime monitoring for defence.