Rare Remote Service (SVCCTL) RPC activity

Cortex XDR Analytics Alert Reference by data source

Product: Cortex XDR
Last date published: 2024-12-03
Category: Analytics Alert Reference
Order: data source

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	NDR Lateral Movement Analytics
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services (T1021)
Severity	Informational

Description

The endpoint performed abnormal RPC activity via Service Control Manager interface to a remote host.

Attacker's Goals

Attackers may attempt to gain persistence or move laterally over the network by executing code on remote hosts using services.
The service control manager RPC interface is used to create and start services on a local or a remote host.

Investigative actions

Review the action of services.exe on the remote host where possible.
Correlate the RPC call from the source host and understand which software initiated it.
Verify that this isn't IT activity.

Variations

Rare Remote Service (SVCCTL) RPC activity

Synopsis

ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services (T1021)
Severity	Low

Description

The endpoint performed abnormal RPC activity via Service Control Manager interface to a remote host.

Attacker's Goals

Attackers may attempt to gain persistence or move laterally over the network by executing code on remote hosts using services.
The service control manager RPC interface is used to create and start services on a local or a remote host.

Investigative actions

Review the action of services.exe on the remote host where possible.
Correlate the RPC call from the source host and understand which software initiated it.
Verify that this isn't IT activity.