Remote Registry Reconnaissance via RPC Firewall

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•22

This rule detects remote procedure calls (RPC) specifically targeting the Remote Registry Protocol (MS-RRP) interface (UUID: 338cd001-2244-31f1-aaaa-900038001003) for information collection. It filters out common administrative operations (OpNum 6, 7, 8, 13, 18, 19, 21, 22, 23, 35) to reduce false positives, focusing on suspicious reconnaissance activities against the registry from a remote system.