Query: detection rule: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping o
Matching passage: Sigma rule: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping o. Logsource: zeek / dce_rpc. Rule: title: MITRE BZAR Indicators for Execution id: b640c0b8-87f8-4daa-aef8-95a24261dd1d status: test description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE references: - https://github.com/mitre-attack/bzar#indicators-for-attck-execution author: '@neu5ron, SOC Prime' date: 2020-03-19 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1047 - attack.t1053.002 - attack.t1569.002 logsource: product: zeek service: dce_rpc detection: op1: endpoint: JobAdd operation: atsvc op2: endpoint: ITaskSchedulerService operation: SchRpcEnableTask op3: endpoint: ITaskSchedulerService operation: SchRpcRegisterTask op4: endpoint: ITaskSchedulerService operation: SchRpcRun op5: endpoint: IWbemServices operation: ExecMethod op6: endpoint: IWbemServices operation: ExecMethodAsync op7: endpoint: svcctl operation: CreateServiceA op8: endpoint: svcctl operation: CreateServiceW op9: endpoint: svcctl operation: StartServiceA op10: endpoint: svcctl operation: StartServiceW condition: 1 of op* falsepositives: - Windows administrator tasks or troubleshooting - Windows management scripts or software level: medium
Near-miss passage: Sigma rule: Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidum. Logsource: windows / process_creation. Rule: title: Process Memory Dump Via Comsvcs.DLL id: 646ea171-dded-4578-8a4d-65e9822892e3 related: - id: 09e6d5c0-05b8-4ff8-9eeb-043046ec774c type: obsolete status: test description: Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.) references: - https://twitter.com/shantanukhande/status/1229348874298388484 - https://twitter.com/pythonresponder/status/1385064506049630211?s=21 - https://twitter.com/Hexacorn/status/1224848930795552769 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ - https://twitter.com/SBousseaden/status/1167417096374050817 - https://twitter.com/Wietze/status/1542107456507203586 - https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s author: Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2020-02-18 modified: 2025-02-23 tags: - attack.credential-access - attack.stealth - attack.t1036 - attack.t1003.001 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: rundll32 selection_cli_1: CommandLine|contains|all: - comsvcs - full CommandLine|contains: - '#-' - '#+' - '#24' - '24 ' - MiniDump - '#65560' selection_generic: CommandLine|contains|all: - '24' - comsvcs - full CommandLine|contains: - ' #' - ',#' - ', #' - '"#' condition: (selection_img and 1 of selection_cli_*) or selection_generic falsepositives: - Unlikely level: high