Remote RPCFW EventID 3: MS-SRVS InterfaceUuid Abuse Indicators

title: "Remote RPCFW EventID 3: MS-SRVS InterfaceUuid Abuse Indicators"
id: 8f4ad66a-0c06-4fd2-a20f-252147286f62
status: test
description: This rule flags RPC firewall events (EventLog RPCFW, EventID 3) for the MS-SRVS interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188. Attackers can use remote RPC to abuse server service functionality, which can support lateral movement or unauthorized remote operations. The detection relies on RPC Firewall application log telemetry, matching the specific event ID and interface UUID.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.lateral-movement
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188
  condition: selection
falsepositives:
  - Legitimate remote share creation
level: high
license: DRL-1.1
related:
  - id: b6ea3cc7-542f-43ef-bbe4-980fbed444c7
    type: derived