MS-RPCE RPC Firewall blocks MS-SRVS remote server service calls (Interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188)
Flags RPC firewall EventID 3 targeting the MS-SRVS interface UUID associated with remote server service abuse.
FreeReviewedSigma · High · v5
- Product
- rpc_firewall
- Category
- application
- Author
- Sagie Dulce, Dekel Paz (SigmaHQ), DRL 1.1
- Published
- 2022-01-01
- Updated
- 2026-07-31
What it detects
This rule flags RPC Firewall events indicating remote MS-SRVS server service calls matching a specific Interface UUID (4b324fc8-1670-01d3-1278-5a47bf6ee188). Attackers can abuse remote server service functionality to support lateral movement and encryption-related operations, so blocking and alerting on these RPC requests is security-relevant. It relies on RPC Firewall audit logs (EventLog: RPCFW) with EventID 3 and the InterfaceUuid value.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
- github.comhttps://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md
- github.comhttps://github.com/zeronetworks/rpcfirewall
- zeronetworks.comhttps://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
remote-rpcfw-eventid-3-ms-srvs-interfaceuuid-abuse-indicators-b6ea3cc7
title: MS-RPCE RPC Firewall blocks MS-SRVS remote server service calls (Interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188)
id: 8f4ad66a-0c06-4fd2-a20f-252147286f62
status: test
description: "This rule flags RPC Firewall events indicating remote MS-SRVS server service calls matching a specific Interface UUID (4b324fc8-1670-01d3-1278-5a47bf6ee188). Attackers can abuse remote server service functionality to support lateral movement and encryption-related operations, so blocking and alerting on these RPC requests is security-relevant. It relies on RPC Firewall audit logs (EventLog: RPCFW) with EventID 3 and the InterfaceUuid value."
references:
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
- https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md
- https://github.com/zeronetworks/rpcfirewall
- https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
- attack.lateral-movement
logsource:
product: rpc_firewall
category: application
definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188'
detection:
selection:
EventLog: RPCFW
EventID: 3
InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188
condition: selection
falsepositives:
- Legitimate remote share creation
level: high
license: DRL-1.1
related:
- id: b6ea3cc7-542f-43ef-bbe4-980fbed444c7
type: derived