MITRE BZAR Indicators for Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.