Sigma rule: Remote Printing Abuse for Lateral Movement

Rule

Title

Remote Printing Abuse for Lateral Movement

Status

test

Level

high

Author

Sagie Dulce, Dekel Paz

Date

2022-01-01

File

rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR

Log source

product

rpc_firewall

category

application

definition

Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:12345678-1234-abcd-ef00-0123456789ab or 76f03f96-cdfd-44fc-a22c-64950a001209 or ae33069b-a2a8-46ee-a235-ddfd339be281 or 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1

Detection

selection:
    EventLog: RPCFW
    EventID: 3
    InterfaceUuid:
        - 12345678-1234-abcd-ef00-0123456789ab
        - 76f03f96-cdfd-44fc-a22c-64950a001209
        - 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1
        - ae33069b-a2a8-46ee-a235-ddfd339be281
condition: selection

False positives (as the rule lists them)

• Actual printing

Tags

• attack.lateral-movement

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1
• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8
• https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RPRN-PAR.md
• https://github.com/zeronetworks/rpcfirewall
• https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml