Sigma rule: Possible DCSync Attack

Rule

Title

Possible DCSync Attack

Status

test

Level

high

Author

Sagie Dulce, Dekel Paz

Date

2022-01-01

File

rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.

Log source

product

rpc_firewall

category

application

definition

Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for "dangerous" opcodes (not 0,1 or 12) only from trusted IPs (DCs)

Detection

selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid: e3514235-4b06-11d1-ab04-00c04fc2dcd2
filter:
    OpNum:
        - 0
        - 1
        - 12
condition: selection and not filter

False positives (as the rule lists them)

• Unknown

Tags

• attack.t1033
• attack.discovery

MITRE ATT&CK ids this rule names

• T1033

References

• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN
• https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md
• https://github.com/zeronetworks/rpcfirewall
• https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml