D3FEND 技术详情
D3-RTA
定义
Monitoring the activity of remote procedure calls in communication traffic to establish standard protocol operations and potential attacker activities.
父技术
子技术
无
关联构件
RPCNetworkTraffic
RPC Network Traffic
RPC network traffic is network traffic related to remote procedure calls between network nodes..This includes only network traffic conforming to a standard RPC protocol; not custom protocols.
语义关系
出向analyzesRPC Network Traffic
出向kb referenceReference - CAR-2014-05-001: RPC Activity - MITRE
出向kb referenceReference - CAR-2014-11-007: Remote Windows Management Instrumentation (WMI) over RPC - MITRE
出向kb referenceReference - CAR-2016-03-002: Create Remote Process via WMIC - MITRE
出向kb referenceReference - RPC call interception - Crowdstrike Inc
出向kb referenceReference - CAR-2014-03-005: Remotely Launched Executables via Services - MITRE
出向kb referenceReference - CAR-2014-12-001: Remotely Launched Executables via WMI - MITRE
出向kb referenceReference - CAR-2015-04-002: Remotely Scheduled Tasks via Schtasks - MITRE
出向kb referenceReference - CAR-2014-03-001: SMB Write Request - NamedPipes - MITRE