RPC Firewall Registry Remote Recon via RRP Interface UUID

title: RPC Firewall Registry Remote Recon via RRP Interface UUID
id: e183f246-17bf-4820-ad5f-4fe6d0afcfe7
status: test
description: This rule flags RPC Firewall EventLog entries indicating remote registry information collection over the MS-RRP interface identified by InterfaceUuid 338cd001-2244-31f1-aaaa-900038001003. Attackers can use these RPC calls to enumerate or gather registry data during discovery and preparation for further activity. It relies on RPC Firewall EventLog telemetry (EventLog=RPCFW, EventID=3) and matches specific RRP method numbers while excluding a defined set of OpNum values.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_remote_registry_recon.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.discovery
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003"'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 338cd001-2244-31f1-aaaa-900038001003
  filter:
    OpNum:
      - 6
      - 7
      - 8
      - 13
      - 18
      - 19
      - 21
      - 22
      - 23
      - 35
  condition: selection and not filter
falsepositives:
  - Remote administration of registry values
level: high
license: DRL-1.1
related:
  - id: d8ffe17e-04be-4886-beb9-c1dd1944b9a8
    type: derived