Remote Server Service Abuse for Lateral Movement via MS-EFSR

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•22

Detects remote RPC calls to potentially abuse the Encrypting File System Remote (EFSR) protocol for lateral movement. This rule specifically looks for events from the RPC Firewall with a particular InterfaceUuid associated with MS-EFSR, indicating an attempt to interact with this service remotely.