Analytics BIOC
High
✕
Remote service command execution from an uncommon source
A remotely triggered service initiated a command execution by a host that rarely triggers services to other remote hosts.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
ATT&CK techniques: Remote Services (T1021) System Services: Service Execution (T1569.002)
Detector tags: Impacket Analytics
Attacker's goals:
Perform lateral movement to new hosts to expand the foothold within a network.
Investigative actions:
Investigate the processes being spawned on the host for malicious activities. Correlate the RPC call from the source host and understand which software initiated it.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day