Rare Remote Service (SVCCTL) RPC activity

Analytics BIOC Informational

Rare Remote Service (SVCCTL) RPC activity

The endpoint performed abnormal RPC activity via Service Control Manager interface to a remote host.

Module:: Platform Analytics
Data source:: Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

ATT&CK tactics: Lateral Movement (TA0008)

ATT&CK techniques: Remote Services (T1021)

Detector tags: NDR Lateral Movement Analytics

Attacker's goals:

Attackers may attempt to gain persistence or move laterally over the network by executing code on remote hosts using services. The service control manager RPC interface is used to create and start services on a local or a remote host.

Investigative actions:

Review the action of services.exe on the remote host where possible. Correlate the RPC call from the source host and understand which software initiated it.* Verify that this isn't IT activity.

Test period:: N/A (single event)
Deduplication:: 1 Day

3 variations:

Rare remote service creation and initiation via Remote Service (SVCCTL) RPC interface Medium (parent: Informational)
Rare remote service change or creation via Remote Service (SVCCTL) RPC interface Medium (parent: Informational)
Rare Remote Service (SVCCTL) RPC activity Low (parent: Informational)