RPC (Remote Procedure Call) to the Internet

 1[metadata]
 2creation_date = "2020/02/18"
 3integration = ["network_traffic"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by
11system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be
12directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or
13backdoor vector.
14"""
15from = "now-9m"
16index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"]
17language = "kuery"
18license = "Elastic License v2"
19name = "RPC (Remote Procedure Call) to the Internet"
20references = ["https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"]
21risk_score = 73
22rule_id = "32923416-763a-4531-bb35-f33b9232ecdb"
23severity = "high"
24tags = ["Tactic: Initial Access", "Domain: Endpoint", "Use Case: Threat Detection"]
25timestamp_override = "event.ingested"
26type = "query"
27
28query = '''
29(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
30  network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and
31  source.ip:(
32    10.0.0.0/8 or
33    172.16.0.0/12 or
34    192.168.0.0/16
35  ) and
36  not destination.ip:(
37    10.0.0.0/8 or
38    127.0.0.0/8 or
39    169.254.0.0/16 or
40    172.16.0.0/12 or
41    192.0.0.0/24 or
42    192.0.0.0/29 or
43    192.0.0.8/32 or
44    192.0.0.9/32 or
45    192.0.0.10/32 or
46    192.0.0.170/32 or
47    192.0.0.171/32 or
48    192.0.2.0/24 or
49    192.31.196.0/24 or
50    192.52.193.0/24 or
51    192.168.0.0/16 or
52    192.88.99.0/24 or
53    224.0.0.0/4 or
54    100.64.0.0/10 or
55    192.175.48.0/24 or
56    198.18.0.0/15 or
57    198.51.100.0/24 or
58    203.0.113.0/24 or
59    240.0.0.0/4 or
60    "::1" or
61    "FE80::/10" or
62    "FF00::/8"
63  )
64'''
65
66
67[[rule.threat]]
68framework = "MITRE ATT&CK"
69[[rule.threat.technique]]
70id = "T1190"
71name = "Exploit Public-Facing Application"
72reference = "https://attack.mitre.org/techniques/T1190/"
73
74
75[rule.threat.tactic]
76id = "TA0001"
77name = "Initial Access"
78reference = "https://attack.mitre.org/tactics/TA0001/"