Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Remote Scheduled Task Creation via RPC
Cortex XDR
This rule detects the creation of scheduled tasks on a remote host via the Task Scheduler RPC interface (opnum 1, RegisterTask). This interface is commonly abused by lateral movement tools such as Impacket's atexec, SharpTask, and SynkLoader to execute code or establish persistence on a remote system.
Detects the abuse of the DFS Namespace Management (DFSNM) interface by monitoring calls to NetrDfsAddStdRoot (opnum 12) and NetrDfsRemoveStdRoot (opnum 13). An adversary can trigger these functions to coerce a Windows host to authenticate to an attacker-controlled remote host using NTLM, facilitating NTLM relay attacks.
Remote Registry Access via Winreg RPC
Cortex XDR
Detects suspicious remote registry operations performed through the Winreg RPC interface. The rule monitors for interactions with sensitive registry hives (e.g., SAM, SECURITY, SYSTEM) or anomalous levels of remote registry activity originating from remote connections (SMB, TCP, Named Pipes). Such activity is often associated with credential dumping tools like Impacket's secretsdump or unauthorized remote configuration discovery.
PetitPotam NTLM Coercion via EFSRPC
Cortex XDR
This rule detects the use of EfsRpcOpenFileRaw (opnum 0) against the EFSRPC interface. This specific function is abused by the PetitPotam exploit to coerce a Windows machine, typically a domain controller, into authenticating to an attacker-controlled host via NTLM. This forced authentication is a precursor to NTLM relay attacks such as those targeting Active Directory Certificate Services (AD CS).
Detects potentially malicious LDAP queries logged by Windows Server 2025 (Event IDs 3039/3040). The rule monitors for common attacker reconnaissance techniques, including Kerberoasting, AS-REP roasting, delegation abuse, AD CS enumeration, and BloodHound-style data collection patterns.
Remote Service Creation via SVCCTL RPC
Cortex XDR
Detects remote service manipulation, including service creation, starting, and deletion, using the SVCCTL RPC interface. This activity is a common method for lateral movement and remote code execution by tools like PsExec, smbexec, and CrackMapExec.
SAMR User and Domain Enumeration via RPC
Cortex XDR
Detects high-volume usage of SAMR RPC functions (SamrEnumerateUsersInDomain, SamrLookupNamesInDomain, SamrQueryInformationUser) used to enumerate domain users and account attributes. This behavior is indicative of reconnaissance activities performed by tools such as secretsdump, BloodHound, and NetExec.
Detects remote registry operations performed through the Winreg RPC interface. This behavior is commonly associated with adversary tools like secretsdump used to extract sensitive Windows registry hives such as SAM, SECURITY, and SYSTEM. Monitoring remote registry access is crucial for identifying unauthorized data collection and credential access attempts.
Detects Kerberos Ticket Granting Service (TGS) requests (Event ID 4769) that use RC4 encryption (0x17). In modern Active Directory environments, RC4 is considered weak and is often explicitly requested by attackers during Kerberoasting to facilitate offline brute-force cracking of service account passwords. The rule excludes common service accounts (e.g., krbtgt, machine accounts) to reduce noise.
Detects remote command execution using WMI by monitoring RPC calls to the IWbemServices interface (UUID {9556DC99-828C-11CF-A37E-00AA003240C7}). The rule specifically targets the ExecMethod operation (opnum 24) commonly used by tools like Impacket's wmiexec to execute Win32_Process.Create on remote targets. Filter for COMSPEC to increase fidelity for detecting wmiexec.
Page 4 of 24