Potential PetitPotam Attack Via EFS RPC Calls

calendar Oct 23, 2025 · attack.collection attack.credential-access attack.t1557.001 attack.t1187  ·
Share on: linkedin copy

Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'

Sigma rule (View on GitHub)

 1title: Potential PetitPotam Attack Via EFS RPC Calls
 2id: 4096842a-8f9f-4d36-92b4-d0b2a62f9b2a
 3status: test
 4description: |
 5    Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.
 6    The usage of this RPC function should be rare if ever used at all.
 7    Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
 8     View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'    
 9references:
10    - https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp
11    - https://msrc.microsoft.com/update-guide/vulnerability/ADV210003
12    - https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf
13    - https://threatpost.com/microsoft-petitpotam-poc/168163/
14author: '@neu5ron, @Antonlovesdnb, Mike Remen'
15date: 2021-08-17
16modified: 2022-11-28
17tags:
18    - attack.collection
19    - attack.credential-access
20    - attack.t1557.001
21    - attack.t1187
22logsource:
23    product: zeek
24    service: dce_rpc
25detection:
26    selection:
27        operation|startswith: 'efs'
28    condition: selection
29fields:
30    - id.orig_h
31    - id.resp_h
32    - id.resp_p
33    - operation
34    - endpoint
35    - named_pipe
36    - uid
37falsepositives:
38    - Uncommon but legitimate windows administrator or software tasks that make use of the Encrypting File System RPC Calls. Verify if this is common activity (see description).
39level: medium

References

Related rules

to-top