Query: alert when Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS
Matching passage: Sigma rule: Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS. Logsource: rpc_firewall / application. Rule: title: Remote Server Service Abuse id: b6ea3cc7-542f-43ef-bbe4-980fbed444c7 status: test description: Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188 condition: selection falsepositives: - Legitimate remote share creation level: high
Near-miss passage: Sigma rule: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active d. Logsource: windows / process_creation. Rule: title: Suspicious Active Directory Database Snapshot Via ADExplorer id: ef61af62-bc74-4f58-b49b-626448227652 related: - id: 9212f354-7775-4e28-9c9f-8f0a4544e664 type: derived status: test description: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 modified: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \ADExp.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe - OriginalFileName: AdExp - Description: Active Directory Editor - Product: Sysinternals ADExplorer selection_flag: CommandLine|contains: snapshot selection_paths: CommandLine|contains: - \Downloads\ - \Users\Public\ - \AppData\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unknown level: high