Remote Server Service RPC Abuse

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•24

This rule detects remote procedure calls (RPC) targeting the MS-SRVS interface (UUID: 4b324fc8-1670-01d3-1278-5a47bf6ee188) which is associated with the Server Service. Abuse of this service can be used for lateral movement within a network, potentially for creating remote shares or other administrative functions. The detection relies on logs from an RPC Firewall.