🐾 - 🔔 DCERPC - Service Control Manager Remote Protocol - Map Response from 🪟 SVCTL interface - Possible Remote Service Stop 🥷 - T1489

SID: 3301155Rev: 317 views
Sourcepawpatrules
CreatedMarch 4, 2024
UpdatedMarch 4, 2024
Classificationattempted-recon
alert tcp-pkt $HOME_NET 135 -> any any (msg:"🐾 - 🔔 DCERPC - Service Control Manager Remote Protocol - Map Response from 🪟 SVCTL interface - Possible Remote Service Stop 🥷 - T1489"; flow:to_client, stateless; content:"|05 00 02|"; content:"|81 bb 7a 36 44 98 f1 35 ad 32 98 f0 38 00 10 03|"; fast_pattern; content:"|04 5d 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60|"; reference:url,https://attack.mitre.org/techniques/T1489/; reference:url,https://learn.microsoft.com/fr-fr/openspecs/windows_protocols/ms-scmr/15fcdce1-424a-4c99-9965-629f2cd53126; reference:url,https://learn.microsoft.com/en-us/openspecs/windows_protocols/MS-SCMR/705b624a-13de-43cc-b8a2-99573da3635f; reference:url,https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e7a38186-cde2-40ad-90c7-650822bd6333; target:src_ip; metadata:created_at 2024_03_04, updated_at 2024_03_04, signature_severity Major, attack_target Client_and_Server, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1489, mitre_technique_name Service_Stop; sid:3301155; rev:3; classtype:attempted-recon;)

References

urlhttps://attack.mitre.org/techniques/T1489/
urlhttps://learn.microsoft.com/fr-fr/openspecs/windows_protocols/ms-scmr/15fcdce1-424a-4c99-9965-629f2cd53126
urlhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/MS-SCMR/705b624a-13de-43cc-b8a2-99573da3635f
urlhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e7a38186-cde2-40ad-90c7-650822bd6333

Metadata

created at2024_03_04
updated at2024_03_04
signature severityMajor
attack targetClient_and_Server
affected productWindows_XP_Vista_7_8_10_11_Server_32_64_Bit
mitre tactic idTA0040
mitre tactic nameImpact
mitre technique idT1489
mitre technique nameService_Stop

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!