Remote Printing Abuse for Lateral Movement — Detection Rule

Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR

Read the full analysis on IntelFusions