Detectionhightest

Remote Schedule Task Lateral Movement via ATSvc

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Sagie Dulce, Dekel PazCreated Sat Jan 010fcd1c79-4eeb-4746-aba9-1b458f7a79cbapplication

Log Source

rpc_firewallapplication

Productrpc_firewall← raw: rpc_firewall

Categoryapplication← raw: application

Definition

Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"

Detection Logic

detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b
        OpNum:
            - 0
            - 1
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0004 · Privilege Escalation TA0008 · Lateral Movement TA0002 · Execution TA0003 · Persistence

Techniques

T1053 · Scheduled Task/Job

Sub-techniques

T1053.002 · At

Rule Metadata

Rule ID

0fcd1c79-4eeb-4746-aba9-1b458f7a79cb

Status

test

Level

high

Type

Detection

Created

Sat Jan 01

Author

Sagie Dulce, Dekel Paz

Path

rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml

Raw Tags

attack.privilege-escalationattack.lateral-movementattack.executionattack.persistenceattack.t1053attack.t1053.002

View on GitHub