title: Remote Procedure Call Service Anomaly
id: a7cd7306-df8b-4398-b711-6f3e4935cf16
status: experimental
description: Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)
author: Florian Roth
references:
   - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809
   - https://www.bleepingcomputer.com/startups/RpcSs.exe-14544.html
   - https://twitter.com/cyb3rops/status/1514217991034097664
date: 2022/04/13
logsource:
   category: process_creation
   product: windows
detection:
   selection:
      ParentCommandLine|startswith: 'C:\WINDOWS\system32\svchost.exe -k RPCSS'
   condition: selection
falsepositives:
   - Unknown
   - Some cases in which the service spawned a werfault.exe process
level: high
tags:
   - attack.initial_access
   - attack.t1190
   - attack.execution
   - attack.t1569.002
