huntrule

Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start

Detects Zeek DCE-RPC calls that match execution-related JobAdd, Task Scheduler, WMI, or service create/start operations.

FreeReviewedSigma · Medium · v2
Product
zeek
Service
dce_rpc
Author
@neu5ron, SOC Prime (SigmaHQ), DRL 1.1
Published
2020-03-19
Updated
2026-07-31
AnalysisDetection
title: "Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start"
id: 1eba031f-2d45-4f10-97b6-95616f89f0cd
status: test
description: This rule flags Zeek DCE-RPC activity on Windows that matches several execution-relevant endpoints and operations, including JobAdd, Task Scheduler RPC calls, WMI ExecMethod/ExecMethodAsync, and service creation/start via svcctl. These patterns matter because they can reflect remote mechanisms used to trigger code execution or persist through Windows management interfaces. It relies on Zeek logs for DCE-RPC endpoint and operation fields to identify matching RPC sequences.
references:
  - https://github.com/mitre-attack/bzar#indicators-for-attck-execution
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml
author: "@neu5ron, SOC Prime, Huntrule Team"
date: 2020-03-19
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1047
  - attack.t1053.002
  - attack.t1569.002
logsource:
  product: zeek
  service: dce_rpc
detection:
  op1:
    endpoint: JobAdd
    operation: atsvc
  op2:
    endpoint: ITaskSchedulerService
    operation: SchRpcEnableTask
  op3:
    endpoint: ITaskSchedulerService
    operation: SchRpcRegisterTask
  op4:
    endpoint: ITaskSchedulerService
    operation: SchRpcRun
  op5:
    endpoint: IWbemServices
    operation: ExecMethod
  op6:
    endpoint: IWbemServices
    operation: ExecMethodAsync
  op7:
    endpoint: svcctl
    operation: CreateServiceA
  op8:
    endpoint: svcctl
    operation: CreateServiceW
  op9:
    endpoint: svcctl
    operation: StartServiceA
  op10:
    endpoint: svcctl
    operation: StartServiceW
  condition: 1 of op*
falsepositives:
  - Windows administrator tasks or troubleshooting
  - Windows management scripts or software
level: medium
license: DRL-1.1
related:
  - id: b640c0b8-87f8-4daa-aef8-95a24261dd1d
    type: derived