Analytics BIOC Low
✕

A remote service was created via RPC over SMB

A remote service was created via RPC over SMB.

Module:
Platform Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
ATT&CK techniques: Remote Services: SMB/Windows Admin Shares (T1021.002) System Services: Service Execution (T1569.002)
Detector tags: Impacket Analytics
Attacker's goals:

Process creation on a remote host.

Investigative actions:

Check whether the new process is benign and that the new process is not doing suspicious activity.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • A remote service with an uncommon name was created via RPC over SMB Medium (parent: Low)