Sigma rule: Remote Schedule Task Lateral Movement via SASec

Rule

Title

Remote Schedule Task Lateral Movement via SASec

Status

test

Level

high

Author

Sagie Dulce, Dekel Paz

Date

2022-01-01

File

rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects remote RPC calls to create or execute a scheduled task via SASec

Log source

product

rpc_firewall

category

application

definition

Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f"

Detection

selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 378e52b0-c0a9-11cf-822d-00aa0051e40f
    OpNum:
        - 0
        - 1
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.lateral-movement
• attack.execution
• attack.persistence
• attack.t1053
• attack.t1053.002

MITRE ATT&CK ids this rule names

• T1053
• T1053.002

References

• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
• https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
• https://github.com/zeronetworks/rpcfirewall
• https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml