Every published rule

Windows Process Creation: Headless Chromium Download via dump-dom

Flags headless Chromium browser executions using dump-dom and an http URL on Windows, indicative of stealthy remote content retrieval.

Windows Registry: RDP PortNumber changed from default 3389

Alerts on Windows registry updates to the RDP-Tcp PortNumber when it changes away from default 3389.

SharpHound RPC Firewall Recon: Remote Mapping and Group Membership Enumeration

Alerts on RPC Firewall EventID 3 for SharpHound-style discovery RPC calls to interface UUID with OpNum 12.

SharpHound Account Recon via RPC Firewall Block (OpNum 2, Interface UUID)

Alerts on RPC Firewall EventID 3 with the Interface UUID and OpNum used by SharpHound for account discovery.

RPC Firewall Alerts for SASec Scheduled Task Discovery (SASec)

Identifies RPC Firewall alerts for SASec interface calls related to scheduled task discovery.

RPC Firewall Alerts for Remote Scheduled Task Creation/Execution via SASec

Identifies remote scheduled task create/execute RPC calls via SASec using RPC Firewall EventLog RPCFW events.

RPC Firewall Logs: Remote Encryption Service RPC Call Detected for Lateral Movement

Alerts on RPC Firewall events indicating remote MS-EFSR encryption service RPC activity that may support lateral movement.

MS-RPCE RPC Firewall blocks MS-SRVS remote server service calls (Interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188)

Flags RPC firewall EventID 3 targeting the MS-SRVS interface UUID associated with remote server service abuse.

RPC Firewall Alerts for Remote Registry Recon via MS-RRP (EventID 3)

Alerts on RPC Firewall RRP calls for remote registry information collection on the monitored interface UUID.

Windows RPC Firewall Registry Modification Calls via MS-RRP OpNums

Alerts on RPC Firewall registry-interface RPC calls (EventID 3) with OpNums tied to remote registry modification.

RPC Firewall detects remote DCOM/WMI-related RPC operations via specified interface UUIDs

Alerts on RPC Firewall RPC events indicating remote DCOM/WMI interface activity that can support lateral movement.

RPC Firewall detects remote printing interface calls (MS-RPRN/MS-PAR) for lateral movement

Alerts on RPC Firewall EventID 3 events for MS-RPRN/MS-PAR remote printing RPC interface UUIDs.

RPC Firewall: Remote Scheduled Task Recon via ITaskSchedulerService (OpNum 1/3/4/10-15)

Flags RPC calls to ITaskSchedulerService that query scheduled task information using RPC firewall telemetry.

Remote ITaskSchedulerService RPC Create/Execute Scheduled Tasks Used for Lateral Movement

Detects RPC Firewall alerts for remote ITaskSchedulerService calls that create or execute scheduled tasks.

Remote Event Log Recon via RPCFW EVEN/EVEN6 EventID 3 (RPC interface UUIDs)

Flags RPC Firewall EventID 3 remote calls querying Windows Event Log data over EVEN/EVEN6 interfaces.

RPC Firewall: Remote MS-EFSR encryption interface calls (EventID 3)

Alerts on RPC Firewall events targeting MS-EFSR interface UUIDs associated with remote encrypting file system abuse.

RPC Firewall Alerts for MS-DRSR DCSync Operations From Non-DC Hosts

Alerts on MS-DRSR RPC Firewall events where non-standard opcodes target the DRSR interface from non-DC hosts.

RPC Firewall AtScv Remote Schedule Task Information Recon

Identifies remote AtScv RPC calls that access scheduled task information via RPC Firewall telemetry.

Windows ATSvc Remote RPC Scheduled Task Creation or Execution (RPC Firewall)

Identifies remote ATSvc RPC calls for scheduled task creation/execution using RPC Firewall EventID 3 and OpNum 0/1.

Windows Winlogon Notify Registry Key DLL Persistence (logon)

Alerts on DLL-specified Winlogon Notify logon entries created via registry set events.