Remote Encrypting File System Abuse via MS-EFSR

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•24

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR. This rule specifically looks for EventID 3 in the RPCFW EventLog, indicating a blocked or audited RPC call, and targets the InterfaceUUIDs associated with the Encrypting File System Remote (EFSR) protocol.