huntrule

Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start

Detects Zeek DCE-RPC calls that match execution-related JobAdd, Task Scheduler, WMI, or service create/start operations.

FreeReviewedSigma · Medium · v2
Product
zeek
Service
dce_rpc
Author
@neu5ron, SOC Prime (SigmaHQ), DRL 1.1
Published
2020-03-19
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Zeek DCE-RPC activity on Windows that matches several execution-relevant endpoints and operations, including JobAdd, Task Scheduler RPC calls, WMI ExecMethod/ExecMethodAsync, and service creation/start via svcctl. These patterns matter because they can reflect remote mechanisms used to trigger code execution or persist through Windows management interfaces. It relies on Zeek logs for DCE-RPC endpoint and operation fields to identify matching RPC sequences.

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange
Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)
Malicious UAT-8302 Remote Process Execution via wmic
Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)
Malicious Impacket Wmiexec Remote Command Execution Pattern
Malicious Shadow Copy Deletion Via WMI
PsExec Remote Service Execution on Target Host (via process_creation)
Suspicious Remote Process Creation via WMIC Process Call Create (via process_creation)
Suspicious System Reconnaissance via WMI Command-Line Queries (via process_creation)
Malicious Impacket WMIexec Process Execution (via process_creation)
Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start
Pivot detection · T1047 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.