MITRE BZAR Indicators for Persistence via DCE-RPC

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•26

This rule detects specific DCE-RPC function calls that are indicative of persistence techniques on a remote Windows system. The detected operations include adding print monitors or print processors, and creating processes with logon credentials, which can be abused by adversaries to maintain access or execute code.