rpc_firewall

Remote DCOM/WMI Lateral Movement

Jun 4, 2025 · attack.lateral-movement attack.execution attack.t1021.003 attack.t1047 ·

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

Remote Registry Lateral Movement

Jun 4, 2025 · attack.lateral-movement attack.t1112 attack.persistence ·

Share on:

Detects remote RPC calls to modify the registry and possible execute code

Remote Schedule Task Lateral Movement via ATSvc

Jun 4, 2025 · attack.lateral-movement attack.execution attack.persistence attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Remote Schedule Task Lateral Movement via SASec

Jun 4, 2025 · attack.lateral-movement attack.execution attack.persistence attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task via SASec

Remote Server Service Abuse for Lateral Movement

Jun 4, 2025 · attack.lateral-movement attack.execution attack.t1569.002 ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Possible DCSync Attack

Jun 4, 2025 · attack.t1033 attack.discovery ·

Share on:

Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.

Recon Activity via SASec

Jun 4, 2025 · attack.discovery ·

Share on:

Detects remote RPC calls to read information about scheduled tasks via SASec

Remote Encrypting File System Abuse

Jun 4, 2025 · attack.lateral-movement ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Remote Event Log Recon

Jun 4, 2025 · attack.discovery ·

Share on:

Detects remote RPC calls to get event log information via EVEN or EVEN6

Remote Printing Abuse for Lateral Movement

Jun 4, 2025 · attack.lateral-movement ·

Share on:

Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR

Remote Registry Recon

Jun 4, 2025 · attack.discovery ·

Share on:

Detects remote RPC calls to collect information

Remote Schedule Task Lateral Movement via ITaskSchedulerService

Jun 4, 2025 · attack.lateral-movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task

Remote Schedule Task Recon via AtScv

Jun 4, 2025 · attack.discovery ·

Share on:

Detects remote RPC calls to read information about scheduled tasks via AtScv

Remote Schedule Task Recon via ITaskSchedulerService

Jun 4, 2025 · attack.discovery ·

Share on:

Detects remote RPC calls to read information about scheduled tasks

Remote Server Service Abuse

Jun 4, 2025 · attack.lateral-movement ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS

SharpHound Recon Account Discovery

Jun 4, 2025 · attack.t1087 attack.discovery ·

Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

SharpHound Recon Sessions

Jun 4, 2025 · attack.discovery attack.t1033 ·

Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.