Remote RPC Scheduled Task Recon via ITaskSchedulerService

title: Remote RPC Scheduled Task Recon via ITaskSchedulerService
id: ecdd5e33-80d1-4b7a-ba43-7fede8d50aba
status: test
description: This rule identifies RPC firewall events where a remote client calls the ITaskSchedulerService interface to retrieve information about scheduled tasks. Such discovery activity can help an attacker map available scheduled tasks and plan follow-on execution or lateral movement. It relies on RPC Firewall event telemetry (EventLog=RPCFW, EventID=3, InterfaceUuid match) and further filters out specific operation numbers.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.discovery
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c
  filter:
    OpNum:
      - 1
      - 3
      - 4
      - 10
      - 11
      - 12
      - 13
      - 14
      - 15
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7f7c49eb-2977-4ac8-8ab0-ab1bae14730e
    type: derived