Remote Registry Modification via RPC
This rule detects remote procedure calls (RPC) to modify the Windows Registry, which can be indicative of lateral movement or persistence mechanisms. Specifically, it monitors for RPC Firewall events with EventID 3 and an InterfaceUuid corresponding to the Remote Registry Protocol (338cd001-2244-31f1-aaaa-900038001003), focusing on specific operation numbers (OpNum) that represent various registry modification functions. This activity could be used by attackers to establish persistence, evade defenses, or execute code remotely.
Sigma
