Stamus Networks MS-TSCH service - ITaskSchedulerService SchRpcEnableTask

SID: 3115135Rev: 40 views
History
Sourcestamus/lateral
CreatedMarch 23, 2022
UpdatedAugust 5, 2024
alert smb any any -> $HOME_NET any (msg:"Stamus Networks MS-TSCH service - ITaskSchedulerService SchRpcEnableTask"; flow:to_server, established; dcerpc.iface:86D35949-83C9-4044-B424-DB363231FD0C; dcerpc.opnum:19; flowbits:set,stamus.tsch.service.ITaskSchedulerService.SchRpcEnableTask; metadata:lateral_key dcerpc.iface, lateral_function SchRpcEnableTask, lateral_asset src_ip, stamus_classification lateral, provider Stamus, created_at 2022_03_23, updated_at 2024_08_05, source smb_lateral, signature_severity Critical; target:dest_ip; sid:3115135; rev:4; reference:url,https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/eb12c947-7e20-4a30-a528-85bc433cec44; reference:url,https://www.stamus-networks.com/blog/new-open-ruleset-for-detecting-lateral-movement-with-suricata; reference:url,https://www.stamus-networks.com/blog/threat-hunting-with-the-open-lateral-movement-ruleset-for-suricata;)

References

urlhttps://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/eb12c947-7e20-4a30-a528-85bc433cec44
urlhttps://www.stamus-networks.com/blog/new-open-ruleset-for-detecting-lateral-movement-with-suricata
urlhttps://www.stamus-networks.com/blog/threat-hunting-with-the-open-lateral-movement-ruleset-for-suricata

Metadata

lateral keydcerpc.iface
lateral functionSchRpcEnableTask
lateral assetsrc_ip
stamus classificationlateral
providerStamus
created at2022_03_23
updated at2024_08_05
sourcesmb_lateral
signature severityCritical

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!