This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
Register Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Community Blog
Subscribe to the official NetWitness Community blog for information about new product features, industry insights, best practices, and more.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Detecting APT Using Anomalous Windows Remote Management Methods and Dynamic RPC Endpoint Mapping

Anonymous
Not applicable
‎2014-12-22 05:18 PM

Great report entitled Detecting APT Using Anomalous Windows Remote Management Methods and Dynamic RPC Endpoint Mapping produced by RSA's Incident Response Team. The paper discusses techniques attackers utilize to work in plain sight by exploiting common management functions.  The report does a great job discussing techniques to help detect these tactics as well. Also attached is a digital appendix that includes a parser for RSA Security Analytics.

rpc_ep_mapping.lua.zip
Labels:
rpc_ep_mapping.lua.zip
728 KB
© 2022 RSA Security LLC or its affiliates. All rights reserved.