sikkerapi
@
prod
~$
Why SikkerAPI
|
Products ▾
Sikker Tools
CLI and server protection tools
▸
Sikker-CLI
SikkerGuard
Web
Free online security tools
▸
Honeypot Database
Email Lookup
Username Lookup
Detection Catalog
Subnet Calculator
Encoder / Decoder
Prices
|
Integrations ▾
Fail2Ban
CSF Firewall
Nginx
iptables / ipset
|
Resources ▾
Blog
API Documentation
Endpoints, auth, and response formats
▸
Overview
IP Check
Blacklist
Report
Bulk Report
TAXII Feed
Sikker-CLI
Confidence Score Algorithm
Intelligence
Browse threat data by country, ASN, and protocol
▸
Top Countries
Top ASNs
Top Protocols
Top IPs
SMTP Database
Guides
Step-by-step setup and configuration
▸
CIDR Range Alerts
IP Alerts
Username Alerts
Email Alerts
Blacklist Web-UI
Install SikkerGuard
|
login
|
signup
Loading
PUB-2026-0307-0003 — SMB Session — remcom_remote_execution | SikkerAPI
← All Sessions
PUB-2026-0307-0003
SMB
Events
3
Behavior
Yes
Primitives
4
Duration
1m 12s
remcom_remote_execution
high
Sequential SMB session opening IPC$, accessing the svcctl pipe, issuing an RPC call, then opening the RemCom_communicaton pipe. Indicates remote service-based command execution.
Session Events
3 events · 1m 12s
0
02:44:11
share
\\[...]\IPC$
1
02:44:11
open
svcctl
2
02:44:12
open
RemCom_communicaton
Matched Primitives
smb_ipc_share_access
smb_svcctl_pipe_open
smb_remcom_pipe_open
smb_empty_rpc_call
Related SMB Sessions
ID
Protocol
Events
Behavior
Primitives
Duration
PUB-2026-0315-0001
SMB
42
No
6
—
PUB-2026-0307-0011
SMB
42
No
6
—
PUB-2026-0305-0034
SMB
8
No
7
5m
PUB-2026-0305-0033
SMB
3
Yes
2
5m 1s
PUB-2026-0305-0006
SMB
4
Yes
5
3m 46s