Detectionhightest

Remote Schedule Task Recon via AtScv

Detects remote RPC calls to read information about scheduled tasks via AtScv

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Sagie Dulce, Dekel PazCreated Sat Jan 01f177f2bc-5f3e-4453-b599-57eefce9a59capplication

Log Source

rpc_firewallapplication

Productrpc_firewall← raw: rpc_firewall

Categoryapplication← raw: application

Definition

Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"

Detection Logic

detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b
    filter:
        OpNum:
            - 0
            - 1
    condition: selection and not filter

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0007 · Discovery

Rule Metadata

Rule ID

f177f2bc-5f3e-4453-b599-57eefce9a59c

Status

test

Level

high

Type

Detection

Created

Sat Jan 01

Author

Sagie Dulce, Dekel Paz

Path

rules/application/rpc_firewall/rpc_firewall_atsvc_recon.yml

Raw Tags

attack.discovery

View on GitHub