Microsoft RPC Firewall: Remote Printing RPC Interface Calls

title: "Microsoft RPC Firewall: Remote Printing RPC Interface Calls"
id: 5536d893-7bd1-4cab-b257-20dbd52b22a1
status: test
description: This rule flags RPC Firewall EventLog entries where EventID 3 references specific interface UUIDs associated with remote printing protocols (MS-RPRN / MS-PAR). Attackers may abuse remote printing capabilities to move laterally by invoking these RPC interfaces across systems. It relies on RPC Firewall telemetry that records RPC interface activity and interface UUIDs for each blocked/monitored call.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RPRN-PAR.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.lateral-movement
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:12345678-1234-abcd-ef00-0123456789ab or 76f03f96-cdfd-44fc-a22c-64950a001209 or ae33069b-a2a8-46ee-a235-ddfd339be281 or 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid:
      - 12345678-1234-abcd-ef00-0123456789ab
      - 76f03f96-cdfd-44fc-a22c-64950a001209
      - 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1
      - ae33069b-a2a8-46ee-a235-ddfd339be281
  condition: selection
falsepositives:
  - Actual printing
level: high
license: DRL-1.1
related:
  - id: bc3a4b0c-e167-48e1-aa88-b3020950e560
    type: derived