DCE-RPC Indicators for Remote Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•32

This rule detects suspicious DCE-RPC function calls that indicate remote execution techniques on a Windows system. It specifically looks for operations related to scheduled tasks (JobAdd, SchRpcEnableTask, SchRpcRegisterTask, SchRpcRun), WMI execution (ExecMethod, ExecMethodAsync), and service creation/start (CreateServiceA/W, StartServiceA/W). These activities are commonly abused by adversaries for initial access, persistence, and lateral movement.