deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious SQL Error Messages
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bjoern Kimminich
Date: 2017-11-27
ATT&CK techniques: T1190
Log source: sql/application

Description:
Detects SQL error messages that indicate probing for an injection attack

Detection logic:
{
  "keywords": [
    "quoted string not properly terminated",
    "You have an error in your SQL syntax",
    "Unclosed quotation mark",
    "near \"*\": syntax error",
    "SELECTs to the left and right of UNION do not have the same number of result columns"
  ],
  "condition": "keywords"
}

References:
  - http://www.sqlinjection.net/errors
Sigma Detection Rule: Potential RCE Exploitation Attempt In NodeJS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Moti Harmats
Date: 2023-02-11
ATT&CK techniques: T1190
Log source: nodejs/application

Description:
Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.

Detection logic:
{
  "keywords": [
    "node:child_process"
  ],
  "condition": "keywords"
}

References:
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
Sigma Detection Rule: Bitbucket Secret Scanning Exempt Repository Added
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1685
Log source: bitbucket/

Description:
Detects when a repository is exempted from secret scanning feature.

Detection logic:
{
  "selection": {
    "auditType.category": "Repositories",
    "auditType.action": "Secret scanning exempt repository added"
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/secret-scanning[PII_REDACTED].html
Sigma Detection Rule: Bitbucket Full Data Export Triggered
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1213.003
Log source: bitbucket/

Description:
Detects when full data export is attempted.

Detection logic:
{
  "selection": {
    "auditType.category": "Data pipeline",
    "auditType.action": "Full data export triggered"
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/adminjiraserver0811/importing-and-exporting-data[PII_REDACTED].html
Sigma Detection Rule: Bitbucket User Login Failure
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1078.004, T1110
Log source: bitbucket/

Description:
Detects user authentication failure events.
Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.


Detection logic:
{
  "selection": {
    "auditType.category": "Authentication",
    "auditType.action": "User login failed"
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
Sigma Detection Rule: Bitbucket User Permissions Export Attempt
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1213, T1082, T1591.004
Log source: bitbucket/

Description:
Detects user permission data export attempt.

Detection logic:
{
  "selection": {
    "auditType.category": "Users and groups",
    "auditType.action": [
      "User details export failed",
      "User details export started",
      "User details exported"
    ]
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/users-and-groups-776640439.html
Sigma Detection Rule: Bitbucket Project Secret Scanning Allowlist Added
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1685
Log source: bitbucket/

Description:
Detects when a secret scanning allowlist rule is added for projects.

Detection logic:
{
  "selection": {
    "auditType.category": "Projects",
    "auditType.action": "Project secret scanning allowlist rule added"
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/secret-scanning[PII_REDACTED].html
Sigma Detection Rule: Bitbucket Global Secret Scanning Rule Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1685
Log source: bitbucket/

Description:
Detects Bitbucket global secret scanning rule deletion activity.

Detection logic:
{
  "selection": {
    "auditType.category": "Global administration",
    "auditType.action": "Global secret scanning rule deleted"
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/secret-scanning[PII_REDACTED].html
Sigma Detection Rule: Bitbucket Global SSH Settings Changed
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1685, T1021.004
Log source: bitbucket/

Description:
Detects Bitbucket global SSH access configuration changes.

Detection logic:
{
  "selection": {
    "auditType.category": "Global administration",
    "auditType.action": "SSH settings changed"
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html
Sigma Detection Rule: Bitbucket Secret Scanning Rule Deleted
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1685
Log source: bitbucket/

Description:
Detects when secret scanning rule is deleted for the project or repository.

Detection logic:
{
  "selection": {
    "auditType.category": [
      "Projects",
      "Repositories"
    ],
    "auditType.action": [
      "Project secret scanning rule deleted",
      "Repository secret scanning rule deleted"
    ]
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/secret-scanning[PII_REDACTED].html
Sigma Detection Rule: Bitbucket Global Permission Changed
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1098
Log source: bitbucket/

Description:
Detects global permissions change activity.

Detection logic:
{
  "selection": {
    "auditType.category": "Permissions",
    "auditType.action": [
      "Global permission remove request",
      "Global permission removed",
      "Global permission granted",
      "Global permission requested"
    ]
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/global-permissions-776640369.html
Sigma Detection Rule: Bitbucket Unauthorized Access To A Resource
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1586
Log source: bitbucket/

Description:
Detects unauthorized access attempts to a resource.

Detection logic:
{
  "selection": {
    "auditType.category": "Security",
    "auditType.action": "Unauthorized access to a resource"
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
Sigma Detection Rule: Bitbucket Audit Log Configuration Updated
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1685
Log source: bitbucket/

Description:
Detects changes to the bitbucket audit log configuration.

Detection logic:
{
  "selection": {
    "auditType.category": "Auditing",
    "auditType.action": "Audit log configuration updated"
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html
Sigma Detection Rule: Bitbucket Unauthorized Full Data Export Triggered
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1213.003, T1586
Log source: bitbucket/

Description:
Detects when full data export is attempted an unauthorized user.

Detection logic:
{
  "selection": {
    "auditType.category": "Data pipeline",
    "auditType.action": "Unauthorized full data export triggered"
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/secret-scanning[PII_REDACTED].html
Sigma Detection Rule: Bitbucket User Login Failure Via SSH
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1021.004, T1110
Log source: bitbucket/

Description:
Detects SSH user login access failures.
Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.


Detection logic:
{
  "selection": {
    "auditType.category": "Authentication",
    "auditType.action": "User login failed(SSH)"
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html
  - https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html
Sigma Detection Rule: Bitbucket User Details Export Attempt Detected
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
ATT&CK techniques: T1213, T1082, T1591.004
Log source: bitbucket/

Description:
Detects user data export activity.

Detection logic:
{
  "selection": {
    "auditType.category": "Users and groups",
    "auditType.action": [
      "User permissions export failed",
      "User permissions export started",
      "User permissions exported"
    ]
  },
  "condition": "selection"
}

References:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts
Sigma Detection Rule: Potential Local File Read Vulnerability In JVM Based Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Moti Harmats
Date: 2023-02-11
ATT&CK techniques: T1190
Log source: jvm/application

Description:
Detects potential local file read vulnerability in JVM based apps.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.


Detection logic:
{
  "keywords_local_file_read": {
    "|all": [
      "FileNotFoundException",
      "/../../.."
    ]
  },
  "condition": "keywords_local_file_read"
}

References:
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
Sigma Detection Rule: Process Execution Error In JVM Based Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Moti Harmats
Date: 2023-02-11
ATT&CK techniques: T1190
Log source: jvm/application

Description:
Detects process execution related exceptions in JVM based apps, often relates to RCE

Detection logic:
{
  "keywords": [
    "Cannot run program",
    "java.lang.ProcessImpl",
    "java.lang.ProcessBuilder"
  ],
  "condition": "keywords"
}

References:
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
Sigma Detection Rule: Potential XXE Exploitation Attempt In JVM Based Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Moti Harmats
Date: 2023-02-11
ATT&CK techniques: T1190
Log source: jvm/application

Description:
Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.

Detection logic:
{
  "keywords": [
    "SAXParseException",
    "DOMException"
  ],
  "condition": "keywords"
}

References:
  - https://rules.sonarsource.com/java/RSPEC-2755
  - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
Sigma Detection Rule: Potential JNDI Injection Exploitation In JVM Based Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Moti Harmats
Date: 2023-02-11
ATT&CK techniques: T1190
Log source: jvm/application

Description:
Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.

Detection logic:
{
  "keywords": [
    "com.sun.jndi.ldap.",
    "org.apache.logging.log4j.core.net.JndiManager"
  ],
  "condition": "keywords"
}

References:
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
  - https://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0
Sigma Detection Rule: Potential OGNL Injection Exploitation In JVM Based Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Moti Harmats
Date: 2023-02-11
ATT&CK techniques: T1190
Log source: jvm/application

Description:
Detects potential OGNL Injection exploitation, which may lead to RCE.
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)


Detection logic:
{
  "keywords": [
    "org.apache.commons.ognl.OgnlException",
    "ExpressionSyntaxException"
  ],
  "condition": "keywords"
}

References:
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
Sigma Detection Rule: SharpHound Recon Account Discovery
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
ATT&CK techniques: T1087
Log source: rpc_firewall/application

Description:
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "6bffd098-a112-3610-9833-46c3f87e345a",
    "OpNum": 2
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-WKST.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Possible DCSync Attack
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
ATT&CK techniques: T1033
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "e3514235-4b06-11d1-ab04-00c04fc2dcd2"
  },
  "filter": {
    "OpNum": [
      0,
      1,
      12
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Schedule Task Lateral Movement via ITaskSchedulerService
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
ATT&CK techniques: T1053, T1053.002
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to create or execute a scheduled task

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "86d35949-83c9-4044-b424-db363231fd0c",
    "OpNum": [
      1,
      3,
      4,
      10,
      11,
      12,
      13,
      14,
      15
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Registry Recon
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to collect information

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "338cd001-2244-31f1-aaaa[PII_REDACTED]03"
  },
  "filter": {
    "OpNum": [
      6,
      7,
      8,
      13,
      18,
      19,
      21,
      22,
      23,
      35
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Schedule Task Lateral Movement via SASec
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
ATT&CK techniques: T1053, T1053.002
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to create or execute a scheduled task via SASec

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "378e52b0-c0a9-11cf-822d-00aa0051e40f",
    "OpNum": [
      0,
      1
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Schedule Task Lateral Movement via ATSvc
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
ATT&CK techniques: T1053, T1053.002
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to create or execute a scheduled task via ATSvc

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "1ff70682-0a51-30e8-076d-740be8cee98b",
    "OpNum": [
      0,
      1
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Server Service Abuse
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Encrypting File System Abuse
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": [
      "df1941c5-fe89-4e79-bf10-463657acf44d",
      "c681d488-d850-11d0-8c52-00c04fd90f7e"
    ]
  },
  "condition": "selection"
}

References:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-EFSR.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Schedule Task Recon via AtScv
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to read information about scheduled tasks via AtScv

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "1ff70682-0a51-30e8-076d-740be8cee98b"
  },
  "filter": {
    "OpNum": [
      0,
      1
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
  - https://github.com/zeronetworks/rpcfirewall
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Registry Lateral Movement
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
ATT&CK techniques: T1112
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to modify the registry and possible execute code

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "338cd001-2244-31f1-aaaa[PII_REDACTED]03",
    "OpNum": [
      6,
      7,
      8,
      13,
      18,
      19,
      21,
      22,
      23,
      35
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/