Network Propagation

This legacy record bundles three separate remote-network procedures: SMB share enumeration (ATT&CK T1135), authenticated SMB/Windows Admin Shares access and execution (T1021.002), and DCOM remote command execution (T1021.003). The SMB and DCOM commands can be run from an Internet-connected operator host only when the relevant target service is reachable there; valid credentials and the target's share, service-control, or COM activation permissions remain required. Share enumeration is not an execution prerequisite, and the DCOM procedure is an alternative path, not a continuation of SMB execution. Split these procedures before treating this as one playbook. The old description's WMI and WinRM claims have no matching steps; WinRM is separately mapped to T1021.006.