# False Positive - RPC (Remote Procedure Call) to the Internet (Kuery)

**URL:** <https://discuss.elastic.co/t/false-positive-rpc-remote-procedure-call-to-the-internet-kuery/231178>\
**Category:** SIEM\
**Created:** [May 5, 2020, 3:02pm UTC](https://discuss.elastic.co/t/false-positive-rpc-remote-procedure-call-to-the-internet-kuery/231178 "2020-05-05T15:02:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\
**Post date:** [May 5, 2020, 3:02pm UTC](https://discuss.elastic.co/t/false-positive-rpc-remote-procedure-call-to-the-internet-kuery/231178/1 "2020-05-05T15:02:45Z")

</div>

There is a built-in detection rule watching for TCP traffic on port 135 to the Internet.

_network.transport: tcp and destination.port: 135 and (network.direction: outbound or (source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)))_

However, this rule has triggered with traffic from local source IP 192.168.1.4 to destination 192.168.1.125 on port 135.

Thanks,  
Gary

---

<div class="post-metadata">

**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\
**Post date:** [May 5, 2020, 3:22pm UTC](https://discuss.elastic.co/t/false-positive-rpc-remote-procedure-call-to-the-internet-kuery/231178/2 "2020-05-05T15:22:08Z")

</div>

I answered my own question.

> <https://github.com/elastic/kibana/issues/57447>
>
> Kibana version: 7.6.0
> Describe the bug:
> Detection rule: "SSH (Secure Shell) from the Internet", contains wrong logical operator which causes the rule to...

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [May 6, 2020, 8:46pm UTC](https://discuss.elastic.co/t/false-positive-rpc-remote-procedure-call-to-the-internet-kuery/231178/3 "2020-05-06T20:46:47Z")

</div>

Thanks for finding it and posting the solution to your own thread. Appreciate it!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 3, 2020, 8:46pm UTC](https://discuss.elastic.co/t/false-positive-rpc-remote-procedure-call-to-the-internet-kuery/231178/4 "2020-06-03T20:46:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.