Rare Remote Service (SVCCTL) RPC activity

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-01-19

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	NDR Lateral Movement Analytics
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services (T1021)
Severity	Informational

The endpoint performed abnormal RPC activity via Service Control Manager interface to a remote host.

Attackers may attempt to gain persistence or move laterally over the network by executing code on remote hosts using services.
The service control manager RPC interface is used to create and start services on a local or a remote host.

Review the action of services.exe on the remote host where possible.
Correlate the RPC call from the source host and understand which software initiated it.
Verify that this isn't IT activity.

The endpoint performed abnormal service creation and initiation via Remote Service (SVCCTL) RPC interface to a remote host.

Attackers may attempt to gain persistence or move laterally over the network by executing code on remote hosts using services.
The service control manager RPC interface is used to create and start services on a local or a remote host.

Review the action of services.exe on the remote host where possible.
Correlate the RPC call from the source host and understand which software initiated it.
Verify that this isn't IT activity.

The endpoint performed abnormal service creation via Remote Service (SVCCTL) RPC interface to a remote host.

Attackers may attempt to gain persistence or move laterally over the network by executing code on remote hosts using services.
The service control manager RPC interface is used to create and start services on a local or a remote host.

Review the action of services.exe on the remote host where possible.
Correlate the RPC call from the source host and understand which software initiated it.
Verify that this isn't IT activity.

The endpoint performed abnormal RPC activity via Service Control Manager interface to a remote host.

Attackers may attempt to gain persistence or move laterally over the network by executing code on remote hosts using services.
The service control manager RPC interface is used to create and start services on a local or a remote host.

Review the action of services.exe on the remote host where possible.
Correlate the RPC call from the source host and understand which software initiated it.
Verify that this isn't IT activity.