Thrift RPC Method from an External Client

  1[metadata]
  2creation_date = "2026/07/30"
  3integration = ["network_traffic"]
  4maturity = "production"
  5updated_date = "2026/07/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the first decoded Apache Thrift RPC relationship from a public client address to a server. Thrift commonly
 11connects trusted internal microservices and data platforms, and an externally originated method invocation can indicate
 12an exposed service, unauthorized access, or exploitation of a public-facing Thrift endpoint.
 13"""
 14false_positives = [
 15    """
 16    Publicly accessible Thrift APIs, partner integrations, remote offices, and routed environments that preserve public
 17    client addresses can generate legitimate alerts. Validate the client, service, method, server role, and expected
 18    network path before escalating.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-network_traffic.thrift-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "Thrift RPC Method from an External Client"
 26note = """## Triage and analysis
 27
 28### Investigating Thrift RPC Method from an External Client
 29
 30Thrift is frequently used by internal microservices and Hadoop ecosystem services such as HBase, Hive, Spark, and Impala. Many deployments rely on network trust or application-specific authentication. This rule uses a five-day new-terms history window to surface the first observed public client and Thrift server pair that completes a decoded method invocation.
 31
 32The alert proves that a Thrift transaction was decoded, but it does not prove authentication bypass or successful exploitation.
 33
 34### Possible investigation steps
 35
 36- Review `client.ip`, `server.ip`, `server.port`, `network_traffic.thrift.service`, `network_traffic.thrift.method`, `network_traffic.thrift.path`, `network_traffic.thrift.exceptions`, and `network.community_id`.
 37- Identify the server application and determine whether the service is intended to accept Internet originated Thrift calls.
 38- Validate the client against partner, VPN, administrator, and approved service inventories.
 39- Review the service IDL and determine whether the invoked method reads sensitive data, changes configuration, deletes resources, or executes jobs.
 40- Correlate with service authentication and audit logs because the passive transaction does not expose authoritative authentication state.
 41
 42### False positive analysis
 43
 44- Authorized partner APIs and intentionally public Thrift services may alert on a new client/server relationship.
 45- NAT, proxies, or sensor placement can cause an expected caller to appear under a public address.
 46- Add narrow exceptions for approved client and server pairs rather than excluding a service or method globally.
 47
 48### Response and remediation
 49
 50- Restrict exposed Thrift listeners to approved networks and require authenticated, encrypted transport.
 51- Block unauthorized clients and isolate the server if sensitive or administrative methods were invoked.
 52- Review downstream data access and endpoint activity for evidence of collection, lateral movement, or execution.
 53"""
 54references = [
 55    "https://nvd.nist.gov/vuln/detail/CVE-2018-1320",
 56    "https://attack.mitre.org/techniques/T1190/",
 57    "https://thrift.apache.org/docs/",
 58]
 59risk_score = 47
 60rule_id = "3b15d24d-03e8-422c-b260-e0834e5fec83"
 61setup = """## Setup
 62
 63This rule requires the Elastic Network Packet Capture integration with the Thrift protocol analyzer enabled. Packetbeat
 64supports TBinary over TSocket or TFramed transport. Compact, JSON, HTTP-wrapped, SASL-wrapped, custom, and encrypted
 65Thrift transports may not decode. Configure the relevant service IDL files so service, method, parameter, and exception
 66names are available where supported.
 67"""
 68severity = "medium"
 69tags = [
 70    "Domain: Network",
 71    "Use Case: Network Security Monitoring",
 72    "Use Case: Threat Detection",
 73    "Tactic: Initial Access",
 74    "Data Source: Network Packet Capture",
 75    "Resources: Investigation Guide",
 76]
 77timestamp_override = "event.ingested"
 78type = "new_terms"
 79
 80query = '''
 81data_stream.dataset:network_traffic.thrift and
 82client.ip:(
 83  * and
 84  not (
 85    10.0.0.0/8 or
 86    100.64.0.0/10 or
 87    127.0.0.0/8 or
 88    169.254.0.0/16 or
 89    172.16.0.0/12 or
 90    192.0.0.0/24 or
 91    192.0.2.0/24 or
 92    192.31.196.0/24 or
 93    192.52.193.0/24 or
 94    192.88.99.0/24 or
 95    192.168.0.0/16 or
 96    192.175.48.0/24 or
 97    198.18.0.0/15 or
 98    198.51.100.0/24 or
 99    203.0.113.0/24 or
100    224.0.0.0/4 or
101    240.0.0.0/4 or
102    "::1" or
103    "fc00::/7" or
104    "fe80::/10" or
105    "ff00::/8"
106  )
107) and
108server.ip:* and
109network_traffic.thrift.method:*
110'''
111
112
113[[rule.threat]]
114framework = "MITRE ATT&CK"
115[[rule.threat.technique]]
116id = "T1190"
117name = "Exploit Public-Facing Application"
118reference = "https://attack.mitre.org/techniques/T1190/"
119
120
121[rule.threat.tactic]
122id = "TA0001"
123name = "Initial Access"
124reference = "https://attack.mitre.org/tactics/TA0001/"
125
126[rule.new_terms]
127field = "new_terms_fields"
128value = ["client.ip", "server.ip"]
129[[rule.new_terms.history_window_start]]
130field = "history_window_start"
131value = "now-5d"