RPC Firewall AtScv Remote Schedule Task Information Recon
Identifies remote AtScv RPC calls that access scheduled task information via RPC Firewall telemetry.
FreeReviewedSigma · High · v5
- Product
- rpc_firewall
- Category
- application
- Author
- Sagie Dulce, Dekel Paz (SigmaHQ), DRL 1.1
- Published
- 2022-01-01
- Updated
- 2026-07-31
What it detects
This rule flags RPC Firewall event logging for remote RPC access to the AtScv interface used to enumerate information about scheduled tasks. Attackers can leverage this visibility to discover task configuration and related execution details before pursuing lateral movement or other follow-on actions. The detection relies on RPCFW EventID 3 telemetry and matches a specific InterfaceUuid while allowing only non-operation-number 0 and 1 calls through the condition.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
- github.comhttps://github.com/zeronetworks/rpcfirewall
- github.comhttps://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
- zeronetworks.comhttps://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_atsvc_recon.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
rpc-firewall-detects-remote-scheduled-task-reconnaissance-via-atscv-f177f2bc
title: RPC Firewall AtScv Remote Schedule Task Information Recon
id: 41803828-6853-42da-86c3-dd0931b7c849
status: test
description: This rule flags RPC Firewall event logging for remote RPC access to the AtScv interface used to enumerate information about scheduled tasks. Attackers can leverage this visibility to discover task configuration and related execution details before pursuing lateral movement or other follow-on actions. The detection relies on RPCFW EventID 3 telemetry and matches a specific InterfaceUuid while allowing only non-operation-number 0 and 1 calls through the condition.
references:
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
- https://github.com/zeronetworks/rpcfirewall
- https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
- https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_atsvc_recon.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
- attack.discovery
logsource:
product: rpc_firewall
category: application
definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"'
detection:
selection:
EventLog: RPCFW
EventID: 3
InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b
filter:
OpNum:
- 0
- 1
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f177f2bc-5f3e-4453-b599-57eefce9a59c
type: derived