Remote Event Log Reconnaissance via RPC Firewall

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•23

Detects remote RPC calls to get event log information via the EVEN or EVEN6 interfaces, which can be indicative of reconnaissance activity by an attacker. This rule specifically targets RPC Firewall logs for these interface UUIDs.