Tag
CVE-2008-4250 - Windows Server Service Buffer Overflow Vulnerability
2 rules 1 TTP 1 CVECVE-2008-4250 is a buffer overflow vulnerability in the Microsoft Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request during path canonicalization.
PhantomRPC: Windows RPC Privilege Escalation Vulnerability
2 rules 1 TTPA vulnerability in Windows RPC architecture allows an attacker to create a fake RPC server and escalate their privileges to SYSTEM level, leveraging processes with impersonation privileges.
CVE-2026-26183 Windows RPC API Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-26183 allows a locally authenticated attacker to escalate privileges due to improper access control within the Windows RPC API.
Detecting External RPC Traffic for Initial Access
2 rules 2 TTPsThis brief focuses on detecting Remote Procedure Call (RPC) traffic originating from the internet, a common initial access vector, by monitoring network connections to TCP port 135 and filtering known internal IP ranges.
Detecting RPC Traffic to the Internet
2 rules 2 TTPsThis brief focuses on detecting Remote Procedure Call (RPC) traffic originating from internal networks and reaching the public internet, which is indicative of potential initial access or backdoor activity.
Remote Registry Lateral Movement via RPC Firewall
2 rules 3 TTPsThis brief details detection of lateral movement attempts using remote RPC calls to modify the registry, potentially leading to code execution, detected via RPC Firewall logs.