Security research

zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall

https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Published on
zeronetworks.com

ATT&CK techniques those detections carry

  • T1053Scheduled Task/Job
  • T1053.002At
  • T1033System Owner/User Discovery
  • T1021.003Distributed Component Object Model
  • T1047Windows Management Instrumentation
  • T1087Account Discovery
  • T1112Modify Registry
  • T1569.002Service Execution
Open the original

17 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
SharpHound Recon SessionsHigh
SharpHound Recon Account DiscoveryHigh
Recon Activity via SASecHigh
Remote Schedule Task Lateral Movement via SASecHigh
Remote Server Service Abuse for Lateral MovementHigh
Remote Server Service AbuseHigh
Remote Registry ReconHigh
Remote Registry Lateral MovementHigh
Remote DCOM/WMI Lateral MovementHigh
Remote Printing Abuse for Lateral MovementHigh
Remote Schedule Task Recon via ITaskSchedulerServiceHigh
Remote Schedule Task Lateral Movement via ITaskSchedulerServiceHigh
Remote Event Log ReconHigh
Remote Encrypting File System AbuseHigh
Possible DCSync AttackHigh
Remote Schedule Task Recon via AtScvHigh
Remote Schedule Task Lateral Movement via ATSvcHigh

Showing 17 of 17

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice