Query: Sigma YAML for rpc_firewall / application
Matching passage: Sigma rule: Detects remote RPC calls to read information about scheduled tasks via AtScv. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Recon via AtScv id: f177f2bc-5f3e-4453-b599-57eefce9a59c status: test description: Detects remote RPC calls to read information about scheduled tasks via AtScv references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/zeronetworks/rpcfirewall - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b filter: OpNum: - 0 - 1 condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy executio. Logsource: windows / image_load. Rule: title: Unsigned DLL Loaded by Windows Utility id: b5de0c9a-6f19-43e0-af4e-55ad01f550af status: test description: 'Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code. ' references: - https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion - https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql - https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true author: Swachchhanda Shrawan Poudel date: 2024-02-28 modified: 2025-10-07 tags: - attack.stealth - attack.t1218.011 - attack.t1218.010 logsource: product: windows category: image_load detection: selection: Image|endswith: - \InstallUtil.exe - \RegAsm.exe - \RegSvcs.exe - \regsvr32.exe - \rundll32.exe filter_main_signed: Signed: 'true' filter_main_sig_status: SignatureStatus: - errorChaining - errorCode_endpoint - errorExpired - trusted - Valid filter_main_signed_null: Signed: null filter_main_signed_empty: Signed: - '' - '-' filter_main_sig_status_null: SignatureStatus: null filter_main_sig_status_empty: SignatureStatus: - '' - '-' filter_main_windows_installer: Image: - C:\Windows\SysWOW64\rundll32.exe - C:\Windows\System32\rundll32.exe ImageLoaded|startswith: C:\Windows\Installer\ ImageLoaded|endswith: - .tmp-\Microsoft.Deployment.WindowsInstaller.dll - .tmp-\Avira.OE.Setup.CustomActions.dll filter_main_assembly: Image|startswith: - C:\Windows\SysWOW64\ - C:\Windows\System32\ - C:\Windows\Microsoft.NET\Framework64 Image|endswith: \RegAsm.exe ImageLoaded|endswith: .dll ImageLoaded|startswith: C:\Windows\assembly\NativeImages filter_optional_klite_codec: Image: - C:\Windows\SysWOW64\regsvr32.exe - C:\Windows\System32\regsvr32.exe ImageLoaded|startswith: - C:\Program Files (x86)\K-Lite Codec Pack\ - C:\Program Files\K-Lite Codec Pack\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium