Windows RPC Firewall alerts on remote scheduled task creation or execution via SASec

title: Windows RPC Firewall alerts on remote scheduled task creation or execution via SASec
id: 980a1f18-392a-41f7-8ef2-ae14e10413cf
status: test
description: "This rule flags RPC traffic that matches a specific RPC interface and operation number, indicating a remote create or execute action for scheduled tasks via SASec. Attackers can use scheduled tasks to execute code remotely while blending into legitimate Windows scheduling mechanisms. The detection relies on RPC Firewall event telemetry (EventLog: RPCFW) including EventID 3, the InterfaceUuid, and the OpNum values 0 and 1."
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.privilege-escalation
  - attack.lateral-movement
  - attack.execution
  - attack.persistence
  - attack.t1053
  - attack.t1053.002
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f"'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 378e52b0-c0a9-11cf-822d-00aa0051e40f
    OpNum:
      - 0
      - 1
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: aff229ab-f8cd-447b-b215-084d11e79eb0
    type: derived