Sigma rule: Remote Schedule Task Lateral Movement via ITaskSchedulerService

Rule

Title

Remote Schedule Task Lateral Movement via ITaskSchedulerService

Status

test

Level

high

Author

Sagie Dulce, Dekel Paz

Date

2022-01-01

File

rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects remote RPC calls to create or execute a scheduled task

Log source

product

rpc_firewall

category

application

definition

Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"

Detection

selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c
    OpNum:
        - 1
        - 3
        - 4
        - 10
        - 11
        - 12
        - 13
        - 14
        - 15
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.persistence
• attack.execution
• attack.lateral-movement
• attack.t1053
• attack.t1053.002

MITRE ATT&CK ids this rule names

• T1053
• T1053.002

References

• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
• https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
• https://github.com/zeronetworks/rpcfirewall
• https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml