elastic / elastic/detection-rules

[Rule Tuning] RPC (Remote Procedure Call) from the Internet

Open
#4,268 4 comments 0 reactions 1 assignee Claimed by @eric-forte-elastic View on GitHub
backlog community Rule: Tuning Team: TRADE
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

### Link to Rule

https://www.elastic.co/guide/en/security/current/rpc-remote-procedure-call-to-the-internet.html

### Rule Tuning Type

Data Quality - Ensuring integrity and quality of data used by detection rules.

### Description

Currently, the Rule will only work with Network Packet Capture and Palo Alto Next-Gen Firewall.

It would be kind if we could have the ability to apply this and similar rules to logs collected by [Fortinet FortiGate Firewall Logs](https://www.elastic.co/docs/current/integrations/fortinet_fortigate) as well.

The following rules there identified in issue #3998 that may be possible to trigger by different vendor Firewalls as well:
- RPC (Remote Procedure Call) to the Internet
- RPC (Remote Procedure Call) from the Internet
- VNC (Virtual Network Computing) to the Internet
- VNC (Virtual Network Computing) from the Internet
- Accepted Default Telnet Port Connection
- Roshal Archive (RAR) or PowerShell File Downloaded from the Internet
- Possible FIN7 DGA Command and Control Behavior
- IPSEC NAT Traversal Port Activity
- SMTP on Port 26/TCP
- Potential Network Sweep Detected
- Potential Network Scan Detected
- Potential SYN-Based Network Scan Detected
- RDP (Remote Desktop Protocol) from the Internet
- SMB (Windows File Sharing) Activity to the Internet

### Example Data

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.