Zeek DCE-RPC Execution Indicators via JobAdd, Task Scheduler, WMI, and Service Control

Detects Zeek DCE-RPC calls that match execution-related JobAdd, Task Scheduler, WMI, or service create/start operations.

FreeUnreviewedSigmamediumv1

zeek-dce-rpc-execution-indicators-via-jobadd-task-scheduler-wmi-and-service-cont-b640c0b8

title: Zeek DCE-RPC Execution Indicators via JobAdd, Task Scheduler, WMI, and Service Control
id: 1eba031f-2d45-4f10-97b6-95616f89f0cd
status: test
description: This rule flags Zeek DCE-RPC activity on Windows systems that matches specific execution-related endpoint and operation combinations, including JobAdd, Task Scheduler service methods, WMI ExecMethod/ExecMethodAsync, and Service Control operations (create/start). These RPC calls can indicate an attacker leveraging remote management mechanisms to execute code or schedule actions on a target system. It relies on Zeek telemetry for DCE-RPC endpoint and operation fields to correlate the suspicious RPC behavior.
references:
  - https://github.com/mitre-attack/bzar#indicators-for-attck-execution
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml
author: "@neu5ron, SOC Prime, Huntrule Team"
date: 2020-03-19
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1047
  - attack.t1053.002
  - attack.t1569.002
logsource:
  product: zeek
  service: dce_rpc
detection:
  op1:
    endpoint: JobAdd
    operation: atsvc
  op2:
    endpoint: ITaskSchedulerService
    operation: SchRpcEnableTask
  op3:
    endpoint: ITaskSchedulerService
    operation: SchRpcRegisterTask
  op4:
    endpoint: ITaskSchedulerService
    operation: SchRpcRun
  op5:
    endpoint: IWbemServices
    operation: ExecMethod
  op6:
    endpoint: IWbemServices
    operation: ExecMethodAsync
  op7:
    endpoint: svcctl
    operation: CreateServiceA
  op8:
    endpoint: svcctl
    operation: CreateServiceW
  op9:
    endpoint: svcctl
    operation: StartServiceA
  op10:
    endpoint: svcctl
    operation: StartServiceW
  condition: 1 of op*
falsepositives:
  - Windows administrator tasks or troubleshooting
  - Windows management scripts or software
level: medium
license: DRL-1.1
related:
  - id: b640c0b8-87f8-4daa-aef8-95a24261dd1d
    type: derived

What it detects

This rule flags Zeek DCE-RPC activity on Windows systems that matches specific execution-related endpoint and operation combinations, including JobAdd, Task Scheduler service methods, WMI ExecMethod/ExecMethodAsync, and Service Control operations (create/start). These RPC calls can indicate an attacker leveraging remote management mechanisms to execute code or schedule actions on a target system. It relies on Zeek telemetry for DCE-RPC endpoint and operation fields to correlate the suspicious RPC behavior.

Known false positives

Windows administrator tasks or troubleshooting
Windows management scripts or software

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.