Zeek DCE-RPC Indicators of Windows Persistence via RPC Printer/Logon Functions

title: Zeek DCE-RPC Indicators of Windows Persistence via RPC Printer/Logon Functions
id: 6fe619d6-a0a4-4b76-91da-7f2a86890669
status: test
description: This rule flags Zeek DCE-RPC activity where the remote RPC endpoint and operation match known persistence-related indicators for Windows. Such RPC calls can be used to alter system behavior or launch processes using specific logon-related functions, which helps attackers establish persistence on a remote host. Detection relies on Zeek DCE-RPC telemetry that records the DCE-RPC endpoint and operation fields for observed sessions.
references:
  - https://github.com/mitre-attack/bzar#indicators-for-attck-persistence
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml
author: "@neu5ron, SOC Prime, Huntrule Team"
date: 2020-03-19
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.004
logsource:
  product: zeek
  service: dce_rpc
detection:
  op1:
    endpoint: spoolss
    operation: RpcAddMonitor
  op2:
    endpoint: spoolss
    operation: RpcAddPrintProcessor
  op3:
    endpoint: IRemoteWinspool
    operation: RpcAsyncAddMonitor
  op4:
    endpoint: IRemoteWinspool
    operation: RpcAsyncAddPrintProcessor
  op5:
    endpoint: ISecLogon
    operation: SeclCreateProcessWithLogonW
  op6:
    endpoint: ISecLogon
    operation: SeclCreateProcessWithLogonExW
  condition: 1 of op*
falsepositives:
  - Windows administrator tasks or troubleshooting
  - Windows management scripts or software
level: medium
license: DRL-1.1
related:
  - id: 53389db6-ba46-48e3-a94c-e0f2cefe1583
    type: derived