Skip to content

Hide Navigation Hide TOC

MITRE BZAR Indicators for Execution (b640c0b8-87f8-4daa-aef8-95a24261dd1d)

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

Cluster A Galaxy A Cluster B Galaxy B Level
At - T1053.002 (f3d95a1f-bba2-44ce-9af7-37866cd63fd0) Attack Pattern MITRE BZAR Indicators for Execution (b640c0b8-87f8-4daa-aef8-95a24261dd1d) Sigma-Rules 1
Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) Attack Pattern MITRE BZAR Indicators for Execution (b640c0b8-87f8-4daa-aef8-95a24261dd1d) Sigma-Rules 1
MITRE BZAR Indicators for Execution (b640c0b8-87f8-4daa-aef8-95a24261dd1d) Sigma-Rules Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4) Attack Pattern 1
Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9) Attack Pattern At - T1053.002 (f3d95a1f-bba2-44ce-9af7-37866cd63fd0) Attack Pattern 2
System Services - T1569 (d157f9d2-d09a-4efa-bb2a-64963f94e253) Attack Pattern Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4) Attack Pattern 2