Zeek DCE/RPC: Encrypting File System (EFS) RPC operations starting with "efs"

title: 'Zeek DCE/RPC: Encrypting File System (EFS) RPC operations starting with "efs"'
id: 06a0e6cf-8c15-4318-997f-478a54645fa0
status: test
description: This rule flags Zeek dce_rpc events where the RPC operation name starts with "efs", indicating use of the Encrypting File System Remote Protocol. Attackers may abuse this uncommon RPC surface to coerce authentication or facilitate credential-related abuse. It relies on Zeek DCE/RPC telemetry, and triage should include surrounding activity from the same source IP (e.g., SMB/NTLM/Kerberos/RDP logs) to determine whether the request is legitimate.
references:
  - https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp
  - https://msrc.microsoft.com/update-guide/vulnerability/ADV210003
  - https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf
  - https://threatpost.com/microsoft-petitpotam-poc/168163/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml
author: "@neu5ron, @Antonlovesdnb, Mike Remen, Huntrule Team"
date: 2021-08-17
modified: 2022-11-28
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1557.001
  - attack.t1187
logsource:
  product: zeek
  service: dce_rpc
detection:
  selection:
    operation|startswith: efs
  condition: selection
falsepositives:
  - Uncommon but legitimate windows administrator or software tasks that make use of the Encrypting File System RPC Calls. Verify if this is common activity (see description).
level: medium
license: DRL-1.1
related:
  - id: 4096842a-8f9f-4d36-92b4-d0b2a62f9b2a
    type: derived