Platform / product

rpc_firewall Sigma detection rules

17 community-maintained Sigma detection rules in the library target the rpc_firewall platform, covering log sources such as application. Browse by severity, inspect the detection logic and MITRE ATT&CK mapping, and open the original Sigma YAML before using a rule in your detection engineering workflow.

17 rules

Log sources

application17

Severity

high17

Possible DCSync Attack
high
Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.
rpc_firewall · application
Recon Activity via SASec
high
Detects remote RPC calls to read information about scheduled tasks via SASec
rpc_firewall · application
Remote DCOM/WMI Lateral Movement
high
Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.
rpc_firewall · application
Remote Encrypting File System Abuse
high
Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR
rpc_firewall · application
Remote Event Log Recon
high
Detects remote RPC calls to get event log information via EVEN or EVEN6
rpc_firewall · application
Remote Printing Abuse for Lateral Movement
high
Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR
rpc_firewall · application
Remote Registry Lateral Movement
high
Detects remote RPC calls to modify the registry and possible execute code
rpc_firewall · application
Remote Registry Recon
high
Detects remote RPC calls to collect information
rpc_firewall · application
Remote Schedule Task Lateral Movement via ATSvc
high
Detects remote RPC calls to create or execute a scheduled task via ATSvc
rpc_firewall · application
Remote Schedule Task Lateral Movement via ITaskSchedulerService
high
Detects remote RPC calls to create or execute a scheduled task
rpc_firewall · application
Remote Schedule Task Lateral Movement via SASec
high
Detects remote RPC calls to create or execute a scheduled task via SASec
rpc_firewall · application
Remote Schedule Task Recon via AtScv
high
Detects remote RPC calls to read information about scheduled tasks via AtScv
rpc_firewall · application
Remote Schedule Task Recon via ITaskSchedulerService
high
Detects remote RPC calls to read information about scheduled tasks
rpc_firewall · application
Remote Server Service Abuse
high
Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS
rpc_firewall · application
Remote Server Service Abuse for Lateral Movement
high
Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR
rpc_firewall · application
SharpHound Recon Account Discovery
high
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
rpc_firewall · application
SharpHound Recon Sessions
high
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
rpc_firewall · application

Log sources

Severity

Possible DCSync Attack

Recon Activity via SASec

Remote DCOM/WMI Lateral Movement

Remote Encrypting File System Abuse

Remote Event Log Recon

Remote Printing Abuse for Lateral Movement

Remote Registry Lateral Movement

Remote Registry Recon

Remote Schedule Task Lateral Movement via ATSvc

Remote Schedule Task Lateral Movement via ITaskSchedulerService

Remote Schedule Task Lateral Movement via SASec

Remote Schedule Task Recon via AtScv

Remote Schedule Task Recon via ITaskSchedulerService

Remote Server Service Abuse

Remote Server Service Abuse for Lateral Movement

SharpHound Recon Account Discovery

SharpHound Recon Sessions