RPC Firewall: Remote Scheduled Task Recon via ITaskSchedulerService (OpNum 1/3/4/10-15)
Flags RPC calls to ITaskSchedulerService that query scheduled task information using RPC firewall telemetry.
FreeReviewedSigma · High · v5
- Product
- rpc_firewall
- Category
- application
- Author
- Sagie Dulce, Dekel Paz (SigmaHQ), DRL 1.1
- Published
- 2022-01-01
- Updated
- 2026-07-31
What it detects
This rule flags RPC Firewall EventLog entries indicating remote RPC requests to the ITaskSchedulerService interface that are consistent with scheduled task information discovery. Such recon can be used to enumerate task-related data before further actions, making it valuable for detecting attacker staging. It relies on RPC Firewall telemetry (EventLog RPCFW, EventID 3) matched to a specific InterfaceUuid and unfiltered operation numbers (OpNum).
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
- github.comhttps://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
- github.comhttps://github.com/zeronetworks/rpcfirewall
- zeronetworks.comhttps://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
remote-rpc-scheduled-task-recon-via-itaskschedulerservice-7f7c49eb
title: "RPC Firewall: Remote Scheduled Task Recon via ITaskSchedulerService (OpNum 1/3/4/10-15)"
id: ecdd5e33-80d1-4b7a-ba43-7fede8d50aba
status: test
description: This rule flags RPC Firewall EventLog entries indicating remote RPC requests to the ITaskSchedulerService interface that are consistent with scheduled task information discovery. Such recon can be used to enumerate task-related data before further actions, making it valuable for detecting attacker staging. It relies on RPC Firewall telemetry (EventLog RPCFW, EventID 3) matched to a specific InterfaceUuid and unfiltered operation numbers (OpNum).
references:
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
- https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
- https://github.com/zeronetworks/rpcfirewall
- https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
- attack.discovery
logsource:
product: rpc_firewall
category: application
definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"'
detection:
selection:
EventLog: RPCFW
EventID: 3
InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c
filter:
OpNum:
- 1
- 3
- 4
- 10
- 11
- 12
- 13
- 14
- 15
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7f7c49eb-2977-4ac8-8ab0-ab1bae14730e
type: derived