huntrule

Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start

Detects Zeek DCE-RPC calls that match execution-related JobAdd, Task Scheduler, WMI, or service create/start operations.

FreeReviewedSigma · Medium · v2
Product
zeek
Service
dce_rpc
Author
@neu5ron, SOC Prime (SigmaHQ), DRL 1.1
Published
2020-03-19
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Zeek DCE-RPC activity on Windows that matches several execution-relevant endpoints and operations, including JobAdd, Task Scheduler RPC calls, WMI ExecMethod/ExecMethodAsync, and service creation/start via svcctl. These patterns matter because they can reflect remote mechanisms used to trigger code execution or persist through Windows management interfaces. It relies on Zeek logs for DCE-RPC endpoint and operation fields to identify matching RPC sequences.

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange
Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)
Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect
Malicious Shadow Copy Deletion via WMIC via Process Creation (via process_creation)
Suspicious System Reconnaissance Output Redirected to PDF File (via process_creation)
Suspicious Phantom Taurus mssq.bat SQL Execution via WMI (via process_creation)
Suspicious Executable Launched from Public Music Staging Directory (via process_creation)
Malicious Antivirus Removal via WMIC Product Uninstall
Malicious Service Execution via PAExec
Suspicious Remote Process Creation via WMIC by Mallox
Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start
Pivot detection · T1047 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.