SharpHound Recon Account Discovery
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
Sigma rule (View on GitHub)
1title: SharpHound Recon Account Discovery
2id: 65f77b1e-8e79-45bf-bb67-5988a8ce45a5
3status: test
4description: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
5references:
6 - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3
7 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-WKST.md
8 - https://github.com/zeronetworks/rpcfirewall
9 - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
10author: Sagie Dulce, Dekel Paz
11date: 2022/01/01
12modified: 2022/01/01
13tags:
14 - attack.t1087
15 - attack.discovery
16logsource:
17 product: rpc_firewall
18 category: application
19 definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:6bffd098-a112-3610-9833-46c3f87e345a opnum:2'
20detection:
21 selection:
22 EventLog: RPCFW
23 EventID: 3
24 InterfaceUuid: 6bffd098-a112-3610-9833-46c3f87e345a
25 OpNum: 2
26 condition: selection
27falsepositives:
28 - Unknown
29level: high
References
-
The NetrWkstaUserEnum method returns details about users who are currently active on a remote computer. unsigned long NetrWkstaUserEnum(
Read More -
A repository that maps commonly used attacks using MSRPC protocols to ATT&CK - jsecurity101/MSRPC-to-ATTACK
Read More -
-
RPC Firewall is a free & open source tool, which detects and protects against RPC based attacks used by ransomware for lateral movement and other attacks
Read More
Related rules
- Reconnaissance Activity Using BuiltIn Commands
- Hacktool Ruler
- Emotet Child Process Spawn Pattern
- Possible DCSync Attack
- Remote Event Log Recon