Tag
PhantomRPC: Windows RPC Privilege Escalation Vulnerability
2 rules 1 TTPA vulnerability in Windows RPC architecture allows an attacker to create a fake RPC server and escalate their privileges to SYSTEM level, leveraging processes with impersonation privileges.
CVE-2026-26183 Windows RPC API Local Privilege Escalation
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-26183 allows a locally authenticated attacker to escalate privileges due to improper access control within the Windows RPC API.
Detecting External RPC Traffic for Initial Access
2 rules 2 TTPsThis brief focuses on detecting Remote Procedure Call (RPC) traffic originating from the internet, a common initial access vector, by monitoring network connections to TCP port 135 and filtering known internal IP ranges.
Detecting RPC Traffic to the Internet
2 rules 2 TTPsThis brief focuses on detecting Remote Procedure Call (RPC) traffic originating from internal networks and reaching the public internet, which is indicative of potential initial access or backdoor activity.
Remote Registry Lateral Movement via RPC Firewall
2 rules 3 TTPsThis brief details detection of lateral movement attempts using remote RPC calls to modify the registry, potentially leading to code execution, detected via RPC Firewall logs.