Possible PetitPotam Attack Through EFS RPC Calls (via dce_rpc)

title: Possible PetitPotam Attack Through EFS RPC Calls (via dce_rpc)
id: 46f8a3e1-d623-56d7-8d7a-c5ca646f4555
status: stable
description: This rule detects use of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam. The use of this RPC function should be rare if ever used at all. Thus use of this function is uncommon enough that any use of this RPC function should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
references:
    - https://attack.mitre.org/techniques/T1187/
    - https://attack.mitre.org/techniques/T1557/001/
    - https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp
    - https://msrc.microsoft.com/update-guide/vulnerability/ADV210003
    - https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf
    - https://threatpost.com/microsoft-petitpotam-poc/168163/
author: 'Huntrule Team'
date: 2026-07-18
tags:
    - attack.collection
    - attack.credential-access
    - attack.t1557.001
    - attack.t1187
logsource:
    product: zeek
    service: dce_rpc
detection:
    selection:
        operation|startswith: 'efs'
    condition: selection
falsepositives:
    - Unknown
level: medium