Abnormal sensitive RPC traffic to multiple hosts

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-01-19

Activation Period	14 Days
Training Period	30 Days
Test Period	5 Hours
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	NDR Lateral Movement Analytics
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services (T1021)
Severity	Low

The endpoint performed unfamiliar RPC activity to multiple hosts using a known sensitive interface.

An adversary may enumerate different protocols to gain information and plan its lateral movement over the network.

Check if the host is a newly deployed server that provides RPC based services to multiple hosts.
Verify the legitimacy of the actor process (and its causality) that initiated this RPC traffic.

The endpoint performed unfamiliar RPC activity to multiple hosts using a known sensitive interface.

An adversary may enumerate different protocols to gain information and plan its lateral movement over the network.

Check if the host is a newly deployed server that provides RPC based services to multiple hosts.
Verify the legitimacy of the actor process (and its causality) that initiated this RPC traffic.