Remote Task Scheduler Lateral Movement via ITaskSchedulerService RPC

title: Remote Task Scheduler Lateral Movement via ITaskSchedulerService RPC
id: a50f0776-2399-408e-ae22-5bc94a8be9d9
status: test
description: This rule flags RPC Firewall events indicating remote interactions with ITaskSchedulerService to create or execute scheduled tasks. Attackers can use scheduled tasks as a persistence and execution mechanism while moving laterally through remote management. The detection relies on RPC Firewall telemetry for RPCFW EventID 3, matching the specific interface UUID and related operation numbers.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.lateral-movement
  - attack.t1053
  - attack.t1053.002
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c
    OpNum:
      - 1
      - 3
      - 4
      - 10
      - 11
      - 12
      - 13
      - 14
      - 15
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d
    type: derived