RPC Firewall Alerts for Remote Registry Recon via MS-RRP (EventID 3)
Alerts on RPC Firewall RRP calls for remote registry information collection on the monitored interface UUID.
FreeReviewedSigma · High · v5
- Product
- rpc_firewall
- Category
- application
- Author
- Sagie Dulce, Dekel Paz (SigmaHQ), DRL 1.1
- Published
- 2022-01-01
- Updated
- 2026-07-31
What it detects
This rule identifies remote MS-RRP registry-related RPC activity that matches a specific interface UUID and is logged as EventID 3 by the RPC Firewall. It focuses on OpNum values associated with information-gathering style interactions, which can indicate reconnaissance prior to further access. The detection relies on RPC Firewall EventLog entries (EventLog=RPCFW, EventID=3, InterfaceUuid match) and narrows to a set of OpNum values while excluding a defined subset.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
- github.comhttps://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md
- github.comhttps://github.com/zeronetworks/rpcfirewall
- zeronetworks.comhttps://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_remote_registry_recon.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
rpc-firewall-registry-remote-recon-via-rrp-interface-uuid-d8ffe17e
title: RPC Firewall Alerts for Remote Registry Recon via MS-RRP (EventID 3)
id: e183f246-17bf-4820-ad5f-4fe6d0afcfe7
status: test
description: This rule identifies remote MS-RRP registry-related RPC activity that matches a specific interface UUID and is logged as EventID 3 by the RPC Firewall. It focuses on OpNum values associated with information-gathering style interactions, which can indicate reconnaissance prior to further access. The detection relies on RPC Firewall EventLog entries (EventLog=RPCFW, EventID=3, InterfaceUuid match) and narrows to a set of OpNum values while excluding a defined subset.
references:
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
- https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md
- https://github.com/zeronetworks/rpcfirewall
- https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_remote_registry_recon.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
- attack.discovery
logsource:
product: rpc_firewall
category: application
definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003"'
detection:
selection:
EventLog: RPCFW
EventID: 3
InterfaceUuid: 338cd001-2244-31f1-aaaa-900038001003
filter:
OpNum:
- 6
- 7
- 8
- 13
- 18
- 19
- 21
- 22
- 23
- 35
condition: selection and not filter
falsepositives:
- Remote administration of registry values
level: high
license: DRL-1.1
related:
- id: d8ffe17e-04be-4886-beb9-c1dd1944b9a8
type: derived