RPC Firewall: Remote EFSR Encryption Service Calls for Lateral Movement

title: "RPC Firewall: Remote EFSR Encryption Service Calls for Lateral Movement"
id: 54530d1a-8f68-4b13-908c-2eaa41b77976
status: test
description: This rule flags RPC Firewall EventLog entries where an incoming remote RPC call targets the specified InterfaceUuid associated with MS-EFSR encryption service activity. Attackers may abuse remote encryption-service functionality to establish or facilitate lateral movement across hosts. The detection relies on RPC Firewall application telemetry, specifically EventLog records with EventID 3 and the matching InterfaceUuid.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SCMR.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_remote_service_lateral_movement.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.lateral-movement
  - attack.execution
  - attack.t1569.002
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:367abb81-9844-35f1-ad32-98f038001003'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 367abb81-9844-35f1-ad32-98f038001003
  condition: selection
falsepositives:
  - Administrative tasks on remote services
level: high
license: DRL-1.1
related:
  - id: 10018e73-06ec-46ec-8107-9172f1e04ff2
    type: derived