Remote Server Service Abuse for Lateral Movement (10018e73-06ec-46ec-8107-9172f1e04ff2)

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4)	Attack Pattern	Remote Server Service Abuse for Lateral Movement (10018e73-06ec-46ec-8107-9172f1e04ff2)	Sigma-Rules	1
Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4)	Attack Pattern	System Services - T1569 (d157f9d2-d09a-4efa-bb2a-64963f94e253)	Attack Pattern	2