RPC Firewall detects remote printing interface calls (MS-RPRN/MS-PAR) for lateral movement
Alerts on RPC Firewall EventID 3 events for MS-RPRN/MS-PAR remote printing RPC interface UUIDs.
FreeReviewedSigma · High · v5
- Product
- rpc_firewall
- Category
- application
- Author
- Sagie Dulce, Dekel Paz (SigmaHQ), DRL 1.1
- Published
- 2022-01-01
- Updated
- 2026-07-31
What it detects
This rule flags RPC Firewall events where an application attempts to call specific remote printing-related interface UUIDs. Such activity can indicate abuse of the remote printing service protocols (MS-RPRN/MS-PAR) to facilitate lateral movement. It relies on RPC Firewall telemetry by matching EventLog "RPCFW" EventID 3 with the listed InterfaceUuid values.
Reporting behind it
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
- learn.microsoft.comhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1
- learn.microsoft.comhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8
- github.comhttps://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RPRN-PAR.md
- github.comhttps://github.com/zeronetworks/rpcfirewall
- zeronetworks.comhttps://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
microsoft-rpc-firewall-remote-printing-rpc-interface-calls-bc3a4b0c
title: RPC Firewall detects remote printing interface calls (MS-RPRN/MS-PAR) for lateral movement
id: 5536d893-7bd1-4cab-b257-20dbd52b22a1
status: test
description: This rule flags RPC Firewall events where an application attempts to call specific remote printing-related interface UUIDs. Such activity can indicate abuse of the remote printing service protocols (MS-RPRN/MS-PAR) to facilitate lateral movement. It relies on RPC Firewall telemetry by matching EventLog "RPCFW" EventID 3 with the listed InterfaceUuid values.
references:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8
- https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RPRN-PAR.md
- https://github.com/zeronetworks/rpcfirewall
- https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
- attack.lateral-movement
logsource:
product: rpc_firewall
category: application
definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:12345678-1234-abcd-ef00-0123456789ab or 76f03f96-cdfd-44fc-a22c-64950a001209 or ae33069b-a2a8-46ee-a235-ddfd339be281 or 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1'
detection:
selection:
EventLog: RPCFW
EventID: 3
InterfaceUuid:
- 12345678-1234-abcd-ef00-0123456789ab
- 76f03f96-cdfd-44fc-a22c-64950a001209
- 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1
- ae33069b-a2a8-46ee-a235-ddfd339be281
condition: selection
falsepositives:
- Actual printing
level: high
license: DRL-1.1
related:
- id: bc3a4b0c-e167-48e1-aa88-b3020950e560
type: derived