Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use
Flags Zeek DCE/RPC calls with operation names starting "efs" that may indicate suspicious EFS RPC usage.
- Product
- zeek
- Service
- dce_rpc
- Author
- @neu5ron, @Antonlovesdnb, Mike Remen (SigmaHQ), DRL 1.1
- Published
- 2021-08-17
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
C2
Exfiltration
Impact
What it detects
This rule flags Zeek DCE/RPC operations whose names start with “efs”, indicating use of an Encrypting File System Remote Protocol-style RPC call. Such RPC activity is rarely observed in normal environments and can be leveraged by attackers to interact with EFS-related services. It relies on Zeek dce_rpc telemetry to capture the RPC operation name and recommends reviewing related surrounding network authentication and SMB/RPC context from the same source IP.
Reporting behind it
- github.comhttps://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/ADV210003
- vx-underground.orghttps://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf
- threatpost.comhttps://threatpost.com/microsoft-petitpotam-poc/168163/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use
id: 06a0e6cf-8c15-4318-997f-478a54645fa0
status: test
description: This rule flags Zeek DCE/RPC operations whose names start with “efs”, indicating use of an Encrypting File System Remote Protocol-style RPC call. Such RPC activity is rarely observed in normal environments and can be leveraged by attackers to interact with EFS-related services. It relies on Zeek dce_rpc telemetry to capture the RPC operation name and recommends reviewing related surrounding network authentication and SMB/RPC context from the same source IP.
references:
- https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp
- https://msrc.microsoft.com/update-guide/vulnerability/ADV210003
- https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf
- https://threatpost.com/microsoft-petitpotam-poc/168163/
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml
author: "@neu5ron, @Antonlovesdnb, Mike Remen, Huntrule Team"
date: 2021-08-17
modified: 2022-11-28
tags:
- attack.collection
- attack.credential-access
- attack.t1557.001
- attack.t1187
logsource:
product: zeek
service: dce_rpc
detection:
selection:
operation|startswith: efs
condition: selection
falsepositives:
- Uncommon but legitimate windows administrator or software tasks that make use of the Encrypting File System RPC Calls. Verify if this is common activity (see description).
level: medium
license: DRL-1.1
related:
- id: 4096842a-8f9f-4d36-92b4-d0b2a62f9b2a
type: derived