Results for “rpc”

Detect DCOM-based lateral movement by correlating Sysmon process creation and network connection events, WMI event analysis, and RPC endpoint mapper traffic to identify abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects.

Analyze Windows Security Event Logs to detect RDP brute force attacks by parsing Event ID 4625 and 4624 entries, identifying source IP frequency, and generating detection reports.

Monitors EVM blockchain addresses and contracts for large transfers, new approvals, contract upgrades, unusual gas spends, MEV interactions, and first-time interactions with new contracts.