RPC Firewall detects remote Windows Event Log recon via EVEN/EVEN6 (EventID 3)

title: RPC Firewall detects remote Windows Event Log recon via EVEN/EVEN6 (EventID 3)
id: 5cf1d730-8cba-4c1d-8dfe-816800551de7
status: test
description: This rule matches RPC Firewall application events where EventID 3 is logged for remote event log information requests using the EVEN/EVEN6 interfaces. Such recon activity can help an attacker enumerate logging and event sources before attempting further discovery or lateral movement. It relies on RPC Firewall telemetry that records the EventLog field, the EventID, and the specific Interface UUIDs associated with the event log RPC endpoints.
references:
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_eventlog_recon.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.discovery
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:82273fdc-e32a-18c3-3f78-827929dc23ea and uuid:f6beaff7-1e19-4fbb-9f8f-b89e2018337c"'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid:
      - 82273fdc-e32a-18c3-3f78-827929dc23ea
      - f6beaff7-1e19-4fbb-9f8f-b89e2018337c
  condition: selection
falsepositives:
  - Remote administrative tasks on Windows Events
level: high
license: DRL-1.1
related:
  - id: 2053961f-44c7-4a64-b62d-f6e72800af0d
    type: derived