RPC Firewall Alerts for MS-DRSR DCSync Operations From Non-DC Hosts

Alerts on MS-DRSR RPC Firewall events where non-standard opcodes target the DRSR interface from non-DC hosts.

FreeReviewedSigma · High · v5

Product: rpc_firewall
Category: application
Author: Sagie Dulce, Dekel Paz (SigmaHQ), DRL 1.1
Published: 2022-01-01
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1033System Owner/User Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags RPC Firewall EventLog entries indicating MS-DRSR interface access with opcodes other than 0, 1, and 12. Because DCSync/DCShadow-related activity can use MS-DRSR remote procedure calls, calls from non-domain-controller sources may indicate unauthorized replication or directory-related abuse. It relies on RPC Firewall telemetry (EventLog RPCFW, EventID 3) including InterfaceUuid and the OpNum value.

Reporting behind it

Related detections9 linkedT1033 — drag to rearrange

Suspicious Whoami Discovery Spawned by Windows Script Host via Process Creation (via process_creation)

Suspicious Localized Administrator Account and Group Enumeration After Citrix Bleed Exploitation

Malicious Recon Output Staged in Qlik Sense Fonts Directory by Cactus Ransomware

Suspicious Host Reconnaissance Command Chain via cmd

Malicious Child Process Spawned From n8n Node Process

Suspicious Credential Enumeration via cmdkey List

Suspicious IIS Worker Process Spawning Whoami Reconnaissance

Suspicious Whoami Execution With Output Redirected to a File (via process_creation)

Possible Logged-On Session Discovery via Quser or Qwinsta (via process_creation)

RPC Firewall Alerts for MS-DRSR DCSync Operations From Non-DC Hosts

Pivot detection · T1033 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

rpc-firewall-ms-drsr-opcode-detections-from-non-domain-controllers-56fda488

title: RPC Firewall Alerts for MS-DRSR DCSync Operations From Non-DC Hosts
id: 6dde9663-c595-49fe-baf5-1feb8e4a90d8
status: test
description: This rule flags RPC Firewall EventLog entries indicating MS-DRSR interface access with opcodes other than 0, 1, and 12. Because DCSync/DCShadow-related activity can use MS-DRSR remote procedure calls, calls from non-domain-controller sources may indicate unauthorized replication or directory-related abuse. It relies on RPC Firewall telemetry (EventLog RPCFW, EventID 3) including InterfaceUuid and the OpNum value.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.t1033
  - attack.discovery
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for "dangerous" opcodes (not 0,1 or 12) only from trusted IPs (DCs)'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: e3514235-4b06-11d1-ab04-00c04fc2dcd2
  filter:
    OpNum:
      - 0
      - 1
      - 12
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 56fda488-113e-4ce9-8076-afc2457922c3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL