Detection rules › Sigma
MITRE BZAR Indicators for Persistence
Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL |
| Privilege Escalation | T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL |
Rule body yaml
title: MITRE BZAR Indicators for Persistence
id: 53389db6-ba46-48e3-a94c-e0f2cefe1583
status: test
description: 'Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.'
references:
- https://github.com/mitre-attack/bzar#indicators-for-attck-persistence
author: '@neu5ron, SOC Prime'
date: 2020-03-19
modified: 2021-11-27
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.004
logsource:
product: zeek
service: dce_rpc
detection:
op1:
endpoint: 'spoolss'
operation: 'RpcAddMonitor'
op2:
endpoint: 'spoolss'
operation: 'RpcAddPrintProcessor'
op3:
endpoint: 'IRemoteWinspool'
operation: 'RpcAsyncAddMonitor'
op4:
endpoint: 'IRemoteWinspool'
operation: 'RpcAsyncAddPrintProcessor'
op5:
endpoint: 'ISecLogon'
operation: 'SeclCreateProcessWithLogonW'
op6:
endpoint: 'ISecLogon'
operation: 'SeclCreateProcessWithLogonExW'
condition: 1 of op*
falsepositives:
- Windows administrator tasks or troubleshooting
- Windows management scripts or software
level: medium
Stages and Predicates
Stage 0: condition
1 of op*Stage 1: op1
op1:
endpoint: 'spoolss'
operation: 'RpcAddMonitor'
Stage 2: op2
op2:
endpoint: 'spoolss'
operation: 'RpcAddPrintProcessor'
Stage 3: op3
op3:
endpoint: 'IRemoteWinspool'
operation: 'RpcAsyncAddMonitor'
Stage 4: op4
op4:
endpoint: 'IRemoteWinspool'
operation: 'RpcAsyncAddPrintProcessor'
Stage 5: op5
op5:
endpoint: 'ISecLogon'
operation: 'SeclCreateProcessWithLogonW'
Stage 6: op6
op6:
endpoint: 'ISecLogon'
operation: 'SeclCreateProcessWithLogonExW'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.