RPC Authentication Coercion to External Target
Detects Remote Procedure Call (RPC) authentication coercion attempts where a machine is forced to authenticate to an external IP address. Attackers use this technique to capture credentials by tricking a server into connecting to a listener they control. This rule identifies known vulnerable RPC interfaces and functions (including rare ones like MS-EVEN/ElfrOpenBELW) being used with a UNC path parameter that points to a public IP address.
Microsoft Sentinel (KQL)
