Sigma rule: Potential PetitPotam Attack Via EFS RPC Calls

Rule

Title

Potential PetitPotam Attack Via EFS RPC Calls

Status

test

Level

medium

Author

@neu5ron, @Antonlovesdnb, Mike Remen

Date

2021-08-17

Modified

2022-11-28

File

rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'

Log source

product

zeek

service

dce_rpc

Detection

selection:
    operation|startswith: 'efs'
condition: selection

False positives (as the rule lists them)

• Uncommon but legitimate windows administrator or software tasks that make use of the Encrypting File System RPC Calls. Verify if this is common activity (see description).

Tags

• attack.collection
• attack.credential-access
• attack.t1557.001
• attack.t1187

MITRE ATT&CK ids this rule names

• T1187
• T1557.001

References

• https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp
• https://msrc.microsoft.com/update-guide/vulnerability/ADV210003
• https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf
• https://threatpost.com/microsoft-petitpotam-poc/168163/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml