Lifting the Fog of War - Monitoring, Identifying and Mitigating MS-RPC Based Threats
summary
Claims that ETW’s RPC provider plus TCP/SMB ETW can map RPC opnum→operation to network addresses by correlating RPC server call events with TCP “accept listener complete” and SMB connection/file-request events. Implements a Python tool called RPC Visibility that forwards correlated records to a query store and successfully flags PSExec via CreateService, DRS GetNCChanges (DCSync), EFS vulnerable calls, Task Scheduler RegisterTask and heuristic WMI calls. Recommends Windows Firewall RPC filters for rapid mitigation but notes opnum filtering and blocking are limited.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:05What is MS-RPC
- 4:56How MS-RPC works
- 10:18Monitoring MS-RPC with ETW
- 16:18RPC and network data
- 18:47RPC Visibility tool
- 19:30Detecting PSExec attacks
- 22:39Detecting DC sync dumping
- 23:21Detecting PetitPotam attacks
- 24:43Detecting task scheduler abuse
- 25:25Detecting WMI attacks
- 27:12RPC Visibility limitations
- 28:16Mitigating with RPC Filters
- 31:52Deploying RPC Filters
- 32:13Summary
- 32:56Q&A
related talks
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
45mD2T1 - Expanding Your WMI Lateral Movement Arsenal
01h 06mComputrace Backdoor Revisited
30mSearching for RPC Functions to Coerce Authentications in Microsoft Protocols
50mNetwork Defender Archeology: An NSM Case Study in Lateral Movement with DCOM
25mInvestigating PowerShell Attacks
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
49mHe Said, She Said – Poisoned RDP Offense and Defense