Analytics Low
✕

Abnormal RPC traffic to multiple hosts

The endpoint performed unfamiliar RPC activity to multiple hosts.

Module:
Platform Analytics
Data source:
Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Reconnaissance (TA0043)
ATT&CK techniques: Active Scanning (T1595) Active Scanning: Vulnerability Scanning (T1595.002)
Attacker's goals:

An adversary may enumerate different protocols to gain information and plan its lateral movement over the network.

Investigative actions:

Check if the host is a newly deployed server that provides RPC based services to multiple hosts. Verify the legitimacy of the actor process (and its causality) that initiated this RPC traffic.

Test period:
1 Hour
Deduplication:
1 Day
1 variation:
  • Abnormal RPC traffic to multiple IPs Informational (parent: Low)