Remote Event Log Recon via RPCFW EVEN/EVEN6 EventID 3 (RPC interface UUIDs)

title: Remote Event Log Recon via RPCFW EVEN/EVEN6 EventID 3 (RPC interface UUIDs)
id: 5cf1d730-8cba-4c1d-8dfe-816800551de7
status: test
description: This rule flags RPC firewall events indicating remote requests for event log information using EVEN or EVEN6, identified by EventID 3. Such recon can help an attacker enumerate or validate access to Windows event logging before further actions. Detection relies on RPCFW application telemetry that includes EventLog, EventID, and the specific InterfaceUuid values involved in the remote call.
references:
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_eventlog_recon.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.discovery
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:82273fdc-e32a-18c3-3f78-827929dc23ea and uuid:f6beaff7-1e19-4fbb-9f8f-b89e2018337c"'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid:
      - 82273fdc-e32a-18c3-3f78-827929dc23ea
      - f6beaff7-1e19-4fbb-9f8f-b89e2018337c
  condition: selection
falsepositives:
  - Remote administrative tasks on Windows Events
level: high
license: DRL-1.1
related:
  - id: 2053961f-44c7-4a64-b62d-f6e72800af0d
    type: derived