Analytics Low
✕

Abnormal sensitive RPC traffic to multiple hosts

The endpoint performed unfamiliar RPC activity to multiple hosts using a known sensitive interface.

Module:
Platform Analytics
Data source:
Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services (T1021)
Detector tags: NDR Lateral Movement Analytics
Attacker's goals:

An adversary may enumerate different protocols to gain information and plan its lateral movement over the network.

Investigative actions:

Check if the host is a newly deployed server that provides RPC based services to multiple hosts. Verify the legitimacy of the actor process (and its causality) that initiated this RPC traffic.

Test period:
5 Hours
Deduplication:
1 Day
1 variation:
  • Abnormal sensitive RPC traffic to multiple IPs Informational (parent: Low)