PetitPotam-style MS-EFSRPC NTLM Coercion (EfsRpcOpenFileRaw)

Ankit Mehta@Secvyn

•updated 6 days ago•0•0•0

Detects anomalous network traffic patterns characteristic of the PetitPotam exploit, specifically targeting the MS-EFSRPC interface on Windows SMB pipes. This behavior is used to force a remote system to initiate authentication to a specified target, facilitating NTLM relay attacks.