Sigma rule: Remote Registry Lateral Movement

Rule

Title

Remote Registry Lateral Movement

Status

test

Level

high

Author

Sagie Dulce, Dekel Paz

Date

2022-01-01

File

rules/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects remote RPC calls to modify the registry and possible execute code

Log source

product

rpc_firewall

category

application

definition

Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003"

Detection

selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 338cd001-2244-31f1-aaaa-900038001003
    OpNum:
        - 6
        - 7
        - 8
        - 13
        - 18
        - 19
        - 21
        - 22
        - 23
        - 35
condition: selection

False positives (as the rule lists them)

• Remote administration of registry values

Tags

• attack.lateral-movement
• attack.defense-impairment
• attack.t1112
• attack.persistence

MITRE ATT&CK ids this rule names

• T1112

References

• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
• https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md
• https://github.com/zeronetworks/rpcfirewall
• https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml