RPC Firewall ATSvc Remote Schedule Task Execution (OpNum 0/1) Detection

title: RPC Firewall ATSvc Remote Schedule Task Execution (OpNum 0/1) Detection
id: c0a2bcd3-befe-4ad5-9df6-659e69baa295
status: test
description: This rule flags RPC Firewall events indicating remote RPC activity against the ATSvc interface, specifically for scheduling or executing tasks (OpNum 0 and 1). Attackers can use ATSvc-based task scheduling to run code on a remote system, supporting execution, persistence, and lateral movement. The detection relies on RPC Firewall telemetry captured in the RPCFW event log, matching EventID 3 for a specific InterfaceUuid and operation numbers.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.privilege-escalation
  - attack.lateral-movement
  - attack.execution
  - attack.persistence
  - attack.t1053
  - attack.t1053.002
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b
    OpNum:
      - 0
      - 1
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb
    type: derived