rpc_firewall

Possible DCSync Attack

Aug 12, 2024 · attack.t1033 attack.discovery ·

Share on:

Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.

Recon Activity via SASec

Aug 12, 2024 · attack.discovery ·

Share on:

Detects remote RPC calls to read information about scheduled tasks via SASec

Remote DCOM/WMI Lateral Movement

Aug 12, 2024 · attack.lateral-movement attack.t1021.003 attack.t1047 ·

Share on:

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

Remote Encrypting File System Abuse

Aug 12, 2024 · attack.lateral-movement ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Remote Event Log Recon

Aug 12, 2024 · attack.discovery ·

Share on:

Detects remote RPC calls to get event log information via EVEN or EVEN6

Remote Printing Abuse for Lateral Movement

Aug 12, 2024 · attack.lateral-movement ·

Share on:

Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR

Remote Registry Lateral Movement

Aug 12, 2024 · attack.lateral-movement attack.t1112 ·

Share on:

Detects remote RPC calls to modify the registry and possible execute code

Remote Registry Recon

Aug 12, 2024 · attack.discovery ·

Share on:

Detects remote RPC calls to collect information

Remote Schedule Task Lateral Movement via ATSvc

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Remote Schedule Task Lateral Movement via ITaskSchedulerService

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task

Remote Schedule Task Lateral Movement via SASec

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task via SASec

Remote Schedule Task Recon via AtScv

Aug 12, 2024 · attack.discovery ·

Share on:

Detects remote RPC calls to read information about scheduled tasks via AtScv

Remote Schedule Task Recon via ITaskSchedulerService

Aug 12, 2024 · attack.discovery ·

Share on:

Detects remote RPC calls to read information about scheduled tasks

Remote Server Service Abuse

Aug 12, 2024 · attack.lateral-movement ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS

Remote Server Service Abuse for Lateral Movement

Aug 12, 2024 · attack.lateral-movement attack.t1569.002 ·

Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

SharpHound Recon Account Discovery

Aug 12, 2024 · attack.t1087 attack.discovery ·

Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

SharpHound Recon Sessions

Aug 12, 2024 · attack.t1033 ·

Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.