SharpHound Account Recon via RPC Firewall Block (OpNum 2, Interface UUID)

Alerts on RPC Firewall EventID 3 with the Interface UUID and OpNum used by SharpHound for account discovery.

FreeReviewedSigma · High · v5

Product: rpc_firewall
Category: application
Author: Sagie Dulce, Dekel Paz (SigmaHQ), DRL 1.1
Published: 2022-01-01
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1087Account Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags RPC Firewall events indicating SharpHound-issued remote procedure calls used for account discovery, specifically mapping remote connections and local group membership. The behavior is important because account discovery is a common early step in lateral movement and privilege targeting. It relies on RPC Firewall EventLog entries (EventID 3) that include InterfaceUuid 6bffd098-a112-3610-9833-46c3f87e345a and OpNum 2.

Reporting behind it

Related detections9 linkedT1087 — drag to rearrange

Suspicious Active Directory Discovery via ADFind

Suspicious Active Directory Enumeration via Sysinternals AD Explorer Snapshot (via process_creation)

Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)

Uncommon ADWS (Port 9389) Connections from Non-Standard Windows Binaries

Windows Process Creation: SOAPHound Execution via AD Data Collection Command-Line Arguments

Windows Process Creation Signals for Pikabot System Discovery

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

SharpHound Account Recon via RPC Firewall Block (OpNum 2, Interface UUID)

Pivot detection · T1087 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

sharphound-account-discovery-via-rpc-firewall-blocking-opnum-2-interface-uuid-ma-65f77b1e

title: SharpHound Account Recon via RPC Firewall Block (OpNum 2, Interface UUID)
id: 57155ff3-2723-46a1-ad8a-8ab40237246b
status: test
description: This rule flags RPC Firewall events indicating SharpHound-issued remote procedure calls used for account discovery, specifically mapping remote connections and local group membership. The behavior is important because account discovery is a common early step in lateral movement and privilege targeting. It relies on RPC Firewall EventLog entries (EventID 3) that include InterfaceUuid 6bffd098-a112-3610-9833-46c3f87e345a and OpNum 2.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-WKST.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.t1087
  - attack.discovery
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:6bffd098-a112-3610-9833-46c3f87e345a opnum:2'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 6bffd098-a112-3610-9833-46c3f87e345a
    OpNum: 2
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 65f77b1e-8e79-45bf-bb67-5988a8ce45a5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL