Remote Scheduled Task Creation/Execution via RPC Firewall

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•25

This rule detects remote procedure call (RPC) activity related to the creation or execution of scheduled tasks using the SASec interface. Specifically, it looks for Event ID 3 from the RPC Firewall log source, where the InterfaceUuid matches '378e52b0-c0a9-11cf-822d-00aa0051e40f' (which corresponds to the Task Scheduler service) and the OpNum is either 0 (SchRpcRegisterTask) or 1 (SchRpcRunTask). This indicates an attempt to remotely register or run a scheduled task, which can be a method for lateral movement, execution, or persistence by adversaries.