Remote Event Log Recon via RPCFW EVEN/EVEN6 EventID 3 (RPC interface UUIDs)
Flags RPC Firewall EventID 3 remote calls querying Windows Event Log data over EVEN/EVEN6 interfaces.
FreeReviewedSigma · High · v5
- Product
- rpc_firewall
- Category
- application
- Author
- Sagie Dulce, Dekel Paz (SigmaHQ), DRL 1.1
- Published
- 2022-01-01
- Updated
- 2026-07-31
What it detects
This rule flags RPC firewall events indicating remote requests for event log information using EVEN or EVEN6, identified by EventID 3. Such recon can help an attacker enumerate or validate access to Windows event logging before further actions. Detection relies on RPCFW application telemetry that includes EventLog, EventID, and the specific InterfaceUuid values involved in the remote call.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
rpc-firewall-detects-remote-windows-event-log-recon-via-even-even6-eventid-3-2053961f
title: Remote Event Log Recon via RPCFW EVEN/EVEN6 EventID 3 (RPC interface UUIDs)
id: 5cf1d730-8cba-4c1d-8dfe-816800551de7
status: test
description: This rule flags RPC firewall events indicating remote requests for event log information using EVEN or EVEN6, identified by EventID 3. Such recon can help an attacker enumerate or validate access to Windows event logging before further actions. Detection relies on RPCFW application telemetry that includes EventLog, EventID, and the specific InterfaceUuid values involved in the remote call.
references:
- https://github.com/zeronetworks/rpcfirewall
- https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_eventlog_recon.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
- attack.discovery
logsource:
product: rpc_firewall
category: application
definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:82273fdc-e32a-18c3-3f78-827929dc23ea and uuid:f6beaff7-1e19-4fbb-9f8f-b89e2018337c"'
detection:
selection:
EventLog: RPCFW
EventID: 3
InterfaceUuid:
- 82273fdc-e32a-18c3-3f78-827929dc23ea
- f6beaff7-1e19-4fbb-9f8f-b89e2018337c
condition: selection
falsepositives:
- Remote administrative tasks on Windows Events
level: high
license: DRL-1.1
related:
- id: 2053961f-44c7-4a64-b62d-f6e72800af0d
type: derived