SharpHound account discovery via RPC Firewall blocking (OpNum 2, Interface UUID match)

title: SharpHound account discovery via RPC Firewall blocking (OpNum 2, Interface UUID match)
id: 57155ff3-2723-46a1-ad8a-8ab40237246b
status: test
description: This rule flags RPC Firewall EventLog entries where an RPC call matches a specific interface UUID and operation number (OpNum 2), as used by SharpHound during remote account and group membership discovery. Attackers rely on this type of discovery to enumerate local and remote relationships before attempting lateral movement. The detection depends on RPC Firewall application telemetry (EventLog RPCFW, EventID 3) with the matching InterfaceUuid and OpNum fields.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-WKST.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.t1087
  - attack.discovery
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:6bffd098-a112-3610-9833-46c3f87e345a opnum:2'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 6bffd098-a112-3610-9833-46c3f87e345a
    OpNum: 2
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 65f77b1e-8e79-45bf-bb67-5988a8ce45a5
    type: derived