Remote DCOM/WMI Lateral Movement

Title: Remote DCOM/WMI Lateral Movement
Status: test
Description:Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.
References:
  -https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
  -https://github.com/zeronetworks/rpcfirewall
  -https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
modified:None
Tags:

• -'attack.lateral-movement'
• -'attack.execution'
• -'attack.t1021.003'
• -'attack.t1047'

Logsource:

• product: rpc_firewall
• category: application
• definition: Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:367abb81-9844-35f1-ad32-98f038001003

Detection:
  selection:
    EventLog: 'RPCFW'
    EventID: '3'
    InterfaceUuid:
      -'4d9f4ab8-7d1c-11cf-861e-0020af6e7c57'
      -'99fcfec4-5260-101b-bbcb-00aa0021347a'
      -'000001a0-0000-0000-c000-000000000046'
      -'00000131-0000-0000-c000-000000000046'
      -'00000143-0000-0000-c000-000000000046'
      -'00000000-0000-0000-c000-000000000046'

  condition:selection
Falsepositives:
  -Some administrative tasks on remote host
Level: high