SharpHound RPC Firewall Recon: Remote Mapping and Group Membership Enumeration

Alerts on RPC Firewall EventID 3 for SharpHound-style discovery RPC calls to interface UUID with OpNum 12.

FreeReviewedSigma · High · v5

Product: rpc_firewall
Category: application
Author: Sagie Dulce, Dekel Paz (SigmaHQ), DRL 1.1
Published: 2022-01-01
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1033System Owner/User Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags RPC Firewall events where SharpHound-related activity triggers a specific RPC interface UUID and operation number. Such RPC calls are used to enumerate and map remote connections and local group membership, which can support later lateral movement. It relies on RPC Firewall application telemetry (EventLog RPCFW, EventID 3) containing the targeted InterfaceUuid and OpNum values.

Reporting behind it

Related detections9 linkedT1033 — drag to rearrange

Suspicious Whoami Discovery Spawned by Windows Script Host via Process Creation (via process_creation)

Suspicious Localized Administrator Account and Group Enumeration After Citrix Bleed Exploitation

Malicious Recon Output Staged in Qlik Sense Fonts Directory by Cactus Ransomware

Suspicious Host Reconnaissance Command Chain via cmd

Malicious Child Process Spawned From n8n Node Process

Suspicious Credential Enumeration via cmdkey List

Suspicious IIS Worker Process Spawning Whoami Reconnaissance

Suspicious Whoami Execution With Output Redirected to a File (via process_creation)

Possible Logged-On Session Discovery via Quser or Qwinsta (via process_creation)

SharpHound RPC Firewall Recon: Remote Mapping and Group Membership Enumeration

Pivot detection · T1033 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

sharphound-discovery-via-rpc-firewall-opnum-12-sessions-6d580420

title: "SharpHound RPC Firewall Recon: Remote Mapping and Group Membership Enumeration"
id: 80c76691-af42-4be4-9255-438ca2a5dff7
status: test
description: This rule flags RPC Firewall events where SharpHound-related activity triggers a specific RPC interface UUID and operation number. Such RPC calls are used to enumerate and map remote connections and local group membership, which can support later lateral movement. It relies on RPC Firewall application telemetry (EventLog RPCFW, EventID 3) containing the targeted InterfaceUuid and OpNum values.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml
author: Sagie Dulce, Dekel Paz, Huntrule Team
date: 2022-01-01
tags:
  - attack.discovery
  - attack.t1033
logsource:
  product: rpc_firewall
  category: application
  definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188 opnum:12'
detection:
  selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188
    OpNum: 12
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6d580420-ff3f-4e0e-b6b0-41b90c787e28
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL