rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml

title: Possible DCSync Attack
id: 56fda488-113e-4ce9-8076-afc2457922c3
status: test
description: Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.
references:
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
tags:
    - attack.t1033
    - attack.discovery
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for "dangerous" opcodes (not 0,1 or 12) only from trusted IPs (DCs)'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: e3514235-4b06-11d1-ab04-00c04fc2dcd2
    filter:
        OpNum:
            - 0
            - 1
            - 12
    condition: selection and not filter
falsepositives:
    - Unknown
level: high
feat(rules): adding rpc_firewall rules 2022-01-10 18:04:43 +02:00			`title: Possible DCSync Attack`
feat(rules): changing location to "application" folder 2022-01-20 11:57:10 +02:00			`id: 56fda488-113e-4ce9-8076-afc2457922c3`
$frack113$ change status to test 2023-01-27 06:48:34 +01:00			`status: test`
feat(rules): adding rpc_firewall rules 2022-01-10 18:04:43 +02:00			`description: Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.`
			`references:`
			`- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN`
Update Ref+Selection 3 2022-07-11 18:12:51 +01:00			`- https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md`
fix(rules): fixed capital in rule names, removed unknown mitre tags, removed unknown tag in logsource. 2022-01-20 16:53:01 +02:00			`- https://github.com/zeronetworks/rpcfirewall`
			`- https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/`
feat(rules): adding rpc_firewall rules 2022-01-10 18:04:43 +02:00			`author: Sagie Dulce, Dekel Paz`
			`date: 2022/01/01`
$frack113$ Revert "Change status of old rules" 2023-01-26 19:37:18 +01:00			`modified: 2022/01/01`
$frack113$ Order yaml field 2022-10-25 06:48:55 +02:00			`tags:`
			`- attack.t1033`
$frack113$ Remove mitre url 2023-01-10 18:09:04 +01:00			`- attack.discovery`
feat(rules): adding rpc_firewall rules 2022-01-10 18:04:43 +02:00			`logsource:`
fix(rules): changed "product" and "service" to suggested values. 2022-01-23 09:44:24 +02:00			`product: rpc_firewall`
			`category: application`
feat(rules): adding rpc_firewall rules 2022-01-10 18:04:43 +02:00			`definition: 'Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for "dangerous" opcodes (not 0,1 or 12) only from trusted IPs (DCs)'`
			`detection:`
			`selection:`
fix(rules): missed stuff from previous fix 2022-01-20 17:27:47 +02:00			`EventLog: RPCFW`
feat(rules): adding rpc_firewall rules 2022-01-10 18:04:43 +02:00			`EventID: 3`
			`InterfaceUuid: e3514235-4b06-11d1-ab04-00c04fc2dcd2`
			`filter:`
Update Ref+Selection 3 2022-07-11 18:12:51 +01:00			`OpNum:`
			`- 0`
			`- 1`
			`- 12`
feat(rules): adding rpc_firewall rules 2022-01-10 18:04:43 +02:00			`condition: selection and not filter`
			`falsepositives:`
			`- Unknown`
			`level: high`